Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 920560" data-attributes="member: 83059">(Pinging [USER=89360]@McMcbrad[/USER])So I just grabbed ESET IS 14 and tested it against my trivial MSIL battery (encrypting My Documents\test recursively), using RIPlace techniques, going through the front door, etc. Other than one sample that ESET wrote a signature for due to an earlier test (which was bypassed by renaming some functions and compiling in a new project), 14 isn&#039;t detecting any of these samples at runtime either. I tried increasing the scope to all of My Documents, same results.On the bright side, as I expected, ESET fantastically detected two of my most recent Emotet samples that have 2/69 VT detection.Maybe they significantly improved the anti-exploit engine but I&#039;m not seeing any general behavior blocker improvements (these kinds of samples are easily flagged by Kaspersky and F-Secure and others).I&#039;m more trying to learn specifically what was changed in 14.x. This is a highly artificial behavior blocker test so I&#039;m happy to change it to more reflect &quot;real&quot; malware, though it would help to know what needs to change to get ESET&#039;s behavior blocker to care.</blockquote>

[QUOTE="MacDefender, post: 920560, member: 83059"] (Pinging [USER=89360]@McMcbrad[/USER]) So I just grabbed ESET IS 14 and tested it against my trivial MSIL battery (encrypting My Documents\test recursively), using RIPlace techniques, going through the front door, etc. Other than one sample that ESET wrote a signature for due to an earlier test (which was bypassed by renaming some functions and compiling in a new project), 14 isn't detecting any of these samples at runtime either. I tried increasing the scope to all of My Documents, same results. On the bright side, as I expected, ESET fantastically detected two of my most recent Emotet samples that have 2/69 VT detection. Maybe they significantly improved the anti-exploit engine but I'm not seeing any general behavior blocker improvements (these kinds of samples are easily flagged by Kaspersky and F-Secure and others). I'm more trying to learn specifically what was changed in 14.x. This is a highly artificial behavior blocker test so I'm happy to change it to more reflect "real" malware, though it would help to know what needs to change to get ESET's behavior blocker to care. [/QUOTE]

Verification