Reply to thread

Message

<blockquote data-quote="Parsh" data-source="post: 875479" data-attributes="member: 58090">Exactly what I meant earlier <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> Looked more like it was a result of code analysis (of system calls for expected behavior) rather than flagging actual behavior.Though the tooltip info of DBI says that it monitors the activities of all running programs. Suspicious characteristics of code being executed like suspicious API call behavior could have led to the flagging.Edit: Just had a look into their <a href="https://www.eset.com/int/about/newsroom/press-releases/research/eset-deep-behavioral-inspection-enables-deeper-monitoring-of-unknown-suspicious-processes/" target="_blank">new whitepaper</a> that says[SPOILER=&quot;Process monitoring&quot;][ATTACH=full]237903[/ATTACH][/SPOILER]Turns out that it&#039;s indeed the system API calls being checked. Not in the binary, but dynamically. DBI monitors the behavior of unknown processes in real-time by hooking into them to monitor the message traffic - and analyze the API calls before they&#039;re executed on the system. If it cannot give a verdict, it may pass on to HIPS.</blockquote>

[QUOTE="Parsh, post: 875479, member: 58090"] Exactly what I meant earlier :) Looked more like it was a result of code analysis (of system calls for expected behavior) rather than flagging actual behavior. Though the tooltip info of DBI says that it monitors the activities of [I]all running programs. S[/I]uspicious characteristics of code being executed like suspicious API call behavior could have led to the flagging. [U]Edit[/U]: Just had a look into their [URL='https://www.eset.com/int/about/newsroom/press-releases/research/eset-deep-behavioral-inspection-enables-deeper-monitoring-of-unknown-suspicious-processes/']new whitepaper[/URL] that says [SPOILER="Process monitoring"] [ATTACH type="full" alt="csm_dbi_in_hips_whitepaper_1c8b311659.png"]237903[/ATTACH] [/SPOILER] Turns out that it's indeed the [I]system API calls[/I] being checked. Not in the binary, but [I]dynamically[/I]. DBI monitors the behavior of unknown processes in real-time by hooking into them to monitor the message traffic - and analyze the API calls before they're executed on the system. If it cannot give a verdict, it may pass on to HIPS. [/QUOTE]

Verification