Malware Hub Report ESET IS - April 2021 Report

[harlan4096]

ESET IS - April 2021 Report

Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use.

__

C: Clean / P: Protected / P - NC: Protected - Not Clean / I: Infected / E: Encrypted

* Dynamic BB Bonus Test (Resident Protection Disabled)
* Partially Blocked
BSR: Before System Reboot
ASR: After System Reboot
H: Blocked by HIPS rules.

April 2021​	Samples Pack​	Static Detection​	Dynamic Detection​	Total Detection​	System Files Encrypted​	2nd Opinion Scanners​	System Final Status​	Thread Link​
01/04/2021​	5​	2 / 5​	1* + 2 / 3​	1* + 4 / 5​	No​	C: HMP I: WV NPE​	BSR: P - NC ASR: P - NC​	Post#2​
02/04/2021​	5​	4 / 5​	0 / 1​	4 / 5​	No​	C​	P​	Post#2​
03/04/2021​	1​	0 / 1​	0 / 1​	0 / 1​	No​	I​	BSR: I ASR: I​	Post#2​
04/04/2021​	5​	3 / 5​	0 / 2​	3 / 5​	No​	C: WV NPE I: NPE​	BSR: I ASR: I​	Post#3​
06/04/2021​	15​	9 / 15​	1 + 1* / 6​	10 + 1* / 15​	Files Wiped​	N/A​	I Files Wiped​	Post#3​
06/04/2021​	4​	4 / 4​	N/A​	4 / 4​	No​	C​	C​	Post#3​
07/04/2021​	3​	0 / 3​	1 / 3​	1 / 3​	No​	C: WV HMP I: NPE​	BSR: I ASR: I​	Post#3​
​	AGGRESSIVE​	SETTINGS​	IN​	REAL-TIME​	MODULES​	SEE​	POST #17​	​
08/04/2021​	1​	1 / 1​	N/A​	1 / 1​	No​	C​	C​	Post#3​
09/04/2021​	8​	4 / 8​	1* / 4​	4 + 1* / 8​	No​	C: HMP I: WV NPE​	BSR: I ASR: I​	Post#3​
15/04/2021​	3​	1 / 3​	2* / 2​	1 + 2* / 3​	No​	C: WV NPE I: NPE​	P - NC​	Post#2​
17/04/2021​	5​	2 / 3​	0 / 3​	2 / 5​	No​	C: WV NPE I: NPE​	BSR: I ASR: I​	Post#4​
18/04/2021​	2​	1 / 2​	0 / 1​	1 / 2​	No​	C: WV HMP I: NPE​	BSR: I ASR: I​	Post#4​
19/04/2021​	2​	0 / 2​	1* / 2​	1* / 2​	No​	C: HMP I: WV NPE​	BSR: I ASR: I​	Post#3​
20/04/2021​	7​	6 / 7​	1 / 1​	7 / 7​	No​	C​	P​	Post#2​
​	HIPS​	+​	FIREWALL​	TWEAKED RULES​	AGAINST​	RANSOMWARE​	POST #29​	​
23/04/2021​	10​	7 / 10​	0 / 3 ​	7 / 10​	No​	C: WV NPE I: WV HMP​	BSR: I P - NC​	Post#3​
25/04/2021​	10​	8 / 10​	2 (H) / 2​	8 + 2 (H) / 10​	No​	C​	P​	Post#2​
28/04/2021​	6​	3 / 6​	3 (H) / 3​	3 + 3 (H) / 6​	No​	C​	P​	Post#2​
29/04/2021​	2​	1 / 2​	1 / 1​	2 / 2​	No​	C​	P​	Post#2​
/04/2021​	-​	/​	/ /​	/ / ​	Yes No​	C I NC​	C I P - NC​	Post#​
/04/2021​	-​	/​	/ /​	/ / ​	Yes No​	C I NC​	C I P - NC​	Post#​
/04/2021​	-​	/​	/ /​	/ / ​	Yes No​	C I NC​	C I P - NC​	Post#​
/04/2021​	-​	/​	/ /​	/ / ​	Yes No​	C I NC​	C I P - NC​	Post#​

 

[blackice]

I would be curious to see how the detection engine changes when set to aggressive? I know in the past it has made little to no difference.

 

[harlan4096]

I will change in 2 days, after 1st week with Defaults Settings...

 

[blackice]

I will change in 2 days, after 1st week with Defaults Settings...

Thank you, as always your testing is appreciated.

 

[MacDefender]

It's nice to see ESET tested again! A lot of the same but some surprises too. As always, their signatures are excellent and the bulk of their protection. The only "dynamic" hits so far are due to signature detections in network-downloaded payloads or files (or file equivalents) that they staged being detected by signatures at runtime.

BazarLoader is a very interesting test case for two reasons:

1. It's a reminder that even though ESET has had good track record with being one of the first to adding signatures and excellent mainstream AV testing results (borderline perfect track record), that doesn't mean it's 100% foolproof. This looks like EXE malware with a fairly high VT detection ratio getting through and infecting the system.
2. It's once again a reminder that ESET is lacking in both its automatic HIPS configuration as well as a dynamic behavior blocker. Looking at the Huorong dynamic hit, the process is setting RunOnce and AutoRun registry keys, shelling out to cmd.exe, and is unsigned. I would be willing to bet that most behavior blockers would flip out about this happening, but ESET lets it right through without taking any action. Setting AutoRuns isn't even something that you need a dynamic injected behavior blocker to monitor -- this is something that I'd argue is the job of a HIPS system to flag.

I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.

 

[harlan4096]

Well, Hourong is not in defaults settings, in fact @Der.Reisende tweaked its HIPS... and ESET HIPS in Automatic seems it is like having nothing

Probably will try to test different settings with ESET in the next weeks...

 

[blackice]

I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.

I think one of the reasons they don't is that they worry about an increase in False Positives, and they have an obsession with keeping those low. Although we know other vendors manage to keep low FP with a good Behavior Blocker.

 

[MacDefender]

I think one of the reasons they don't is that they worry about an increase in False Positives, and they have an obsession with keeping those low. Although we know other vendors manage to keep low FP with a good Behavior Blocker.

Yeah false positives and performance impact are both considerations. Also, it seems to me like most AVs that have a first party BB start de-prioritizing their signature quality (BitDefender being the classic example though they are not alone) because they assume their BB will do more of the heavy lifting.

 

[upnorth]

I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.

Very possible, but personal I would lean my attention in that case to a much more unknown vendor like Ikarus :

Malware Hub Report - Ikarus AV - May 2020 Report

Ikarus AV - May 2020 Report Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use. __ C: Clean / P: Protected / P - NC: Protected -...

malwaretips.com

that I see on many early detections. ESET is one of the " Top Dog " in that field, but as I also mentioned with other vendors, their strength, can also easy become their weakness. That's why the upcoming tests with tweaked settings will be extra interesting. Hopefully those results will improve.

 

[Local Host]

It's nice to see ESET tested again! A lot of the same but some surprises too. As always, their signatures are excellent and the bulk of their protection. The only "dynamic" hits so far are due to signature detections in network-downloaded payloads or files (or file equivalents) that they staged being detected by signatures at runtime.

BazarLoader is a very interesting test case for two reasons:

1. It's a reminder that even though ESET has had good track record with being one of the first to adding signatures and excellent mainstream AV testing results (borderline perfect track record), that doesn't mean it's 100% foolproof. This looks like EXE malware with a fairly high VT detection ratio getting through and infecting the system.
2. It's once again a reminder that ESET is lacking in both its automatic HIPS configuration as well as a dynamic behavior blocker. Looking at the Huorong dynamic hit, the process is setting RunOnce and AutoRun registry keys, shelling out to cmd.exe, and is unsigned. I would be willing to bet that most behavior blockers would flip out about this happening, but ESET lets it right through without taking any action. Setting AutoRuns isn't even something that you need a dynamic injected behavior blocker to monitor -- this is something that I'd argue is the job of a HIPS system to flag.

I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.

This is actually a good show for people that claim ESET is properly setup out of the box, and that is set and forget.

ESET is not a bad AV, but is not for casual users, need to be properly configured and monitored.

It doesn't compare to the likes of Kaspersky which is actually set and forget.

 

[Divine_Barakah]

This is actually a good show for people that claim ESET is properly setup out of the box, and that is set and forget.

ESET is not a bad AV, but is not for casual users, need to be properly configured and monitored.

It doesn't compare to the likes of Kaspersky which is actually set and forget.

Well, I have to disagree here. Eset is more than enough for most users and the default settings are good enough at protecting the system. What are the chances of an average user getting hit by a zero day malware? Even if it happens, the malware would be detected by Eset after a short time and other users would be protected, so it is not a big deal.

 

[upnorth]

It doesn't compare to the likes of Kaspersky

Spoiler

 

[MacDefender]

Well, I have to disagree here. Eset is more than enough for most users and the default settings are good enough at protecting the system. What are the chances of an average user getting hit by a zero day malware? Even if it happens, the malware would be detected by Eset after a short time and other users would be protected, so it is not a big deal.

I think ESET's defaults are fairly sensible and for that product I think it is the way that most customers would want to run it. It is interesting though that ESET uniquely has a pretty powerful but untapped subsystem (HIPS) that is largely idle/unused by default except perhaps as a way to address major zero-day attacks that evade their signatures. With that said, configuring the HIPS properly requires both expertise and patience and, in my opinion, is not a practical choice for the average user who benefits from something like a behavior blocker. It is better suited for enterprise settings and servers which have a more static set of workflows so the user is less likely to hit a false positive from their HIPS ruleset.

The biggest benefit of a behavior blocker is not for stopping true zero day (entirely unknown) malware. It's that signature-specific behavior blocker detections are a great way of dealing with obfuscated malware and scriptors in particular. It's so easy to obfuscate that kind of malware that many of them do have automatic per-download obfuscation that is really hard to statically analyze. However, it's a lot harder for them to hide what they are trying to do when they run, which is why Kaspersky System Watcher and DeepGuard both contain detections for specific types of malware, not just general "oops you tried to register an AutoRun".

EDIT: With that said, in general ESET does a great job at using signatures and machine learning to solve this problem statically. In this particular case, I found it interesting that the way this malware evaded ESET's static detections would have been caught by a very basic behavior blocker.

 

[blackice]

I think ESET's defaults are fairly sensible and for that product I think it is the way that most customers would want to run it. It is interesting though that ESET uniquely has a pretty powerful but untapped subsystem (HIPS) that is largely idle/unused by default except perhaps as a way to address major zero-day attacks that evade their signatures. With that said, configuring the HIPS properly requires both expertise and patience and, in my opinion, is not a practical choice for the average user who benefits from something like a behavior blocker. It is better suited for enterprise settings and servers which have a more static set of workflows so the user is less likely to hit a false positive from their HIPS ruleset.

The biggest benefit of a behavior blocker is not for stopping true zero day (entirely unknown) malware. It's that signature-specific behavior blocker detections are a great way of dealing with obfuscated malware and scriptors in particular. It's so easy to obfuscate that kind of malware that many of them do have automatic per-download obfuscation that is really hard to statically analyze. However, it's a lot harder for them to hide what they are trying to do when they run, which is why Kaspersky System Watcher and DeepGuard both contain detections for specific types of malware, not just general "oops you tried to register an AutoRun".

EDIT: With that said, in general ESET does a great job at using signatures and machine learning to solve this problem statically. In this particular case, I found it interesting that the way this malware evaded ESET's static detections would have been caught by a very basic behavior blocker.

I agree. I think it is well setup for a good balance. Would I recommend it for a happy clicker with low tech knowledge? No. But I’d recommend it to anyone with decent basic internet hygiene. Of course I’d say that about Microsoft Defender as well. It’s not the best in terms of protection as we see in the hub, but far from the worst. It is one of the best for usability for many people.

 

[Minimalist]

ESET's HIPS on it's own probably won't block much. That's why they've published HIPS rules that administrators can set up in organisation to prevent some ransomware attack scenarios: [KB6119] Configure HIPS rules for ESET business products to protect against ransomware
They've also published firewall rules for similar purpose: [KB6132] Configure firewall rules for ESET Endpoint Security to protect against ransomware

Most users of course won't be able to set this up. But they most likely won't encounter zero day if they practice safe computing. If they still get hit by one, they would probably have better chances with Kaspersky or some other solution with good BB.

 

[SFox]

Hello. When you set up hips, then write down these registry keys This was recommended to me by a familiar user. The action is to ask the user.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath

Antivirus developers also advise a whole list for protection. support.eset.com/en/kb6119-configure-hips-rules-for-eset-business-products-to-protect-against-ransomware

 

[harlan4096]

These are the settings I've implemented for the upcoming tests:







I will implement some HIPS tweaks later, probably for the last 2 weeks of the month...

 

[Raiden]

These are the settings I've implemented for the upcoming tests:

View attachment 256620

View attachment 256622

View attachment 256623

I will implement some HIPS tweaks later, probably for the last 2 weeks of the month...

I'm curious to see what impact these settings have. I wont lie, I do like that flexibility to tune the ML aspect, especially for different types of detections.

 

[The_King]

These are the settings I've implemented for the upcoming tests:

View attachment 256620

View attachment 256622

View attachment 256623

I will implement some HIPS tweaks later, probably for the last 2 weeks of the month...

I remember ESET NOD32 being a tiny AV when I used it years ago. To see how much it has changed is quiet impressive!

 

[venustus]

I'm curious to see what impact these settings have

I have felt a slight impact especially when launching a program with these more aggressive settings