ESET IS - April 2021 Report

harlan4096

Moderator
Thread author
Verified
Staff Member
Malware Hunter
Well-known
Apr 28, 2015
8,635
ESET IS - April 2021 Report
Due to the small number of samples used in this tests, you should take results with a grain of salt. We encourage you to compare these results with others and take informed decisions on what security products to use.
__

C: Clean / P: Protected / P - NC: Protected - Not Clean / I: Infected / E: Encrypted

* Dynamic BB Bonus Test (Resident Protection Disabled)
* Partially Blocked
BSR: Before System Reboot

ASR: After System Reboot
H: Blocked by HIPS rules.


April
2021​
Samples
Pack​
Static
Detection​
Dynamic
Detection​
Total
Detection​
System Files
Encrypted​
2nd Opinion
Scanners​
System
Final Status​
Thread
Link​
01/04/2021
5
2 / 5
1* + 2 / 3
1* + 4 / 5
No
C: HMP
I: WV NPE
BSR: P - NC
ASR: P - NC
02/04/2021
5
4 / 5
0 / 1
4 / 5
No
C
P
03/04/2021
1
0 / 1
0 / 1
0 / 1
No
I
BSR: I
ASR: I
04/04/2021
5
3 / 5
0 / 2
3 / 5
No
C: WV NPE
I: NPE
BSR: I
ASR: I
06/04/2021
15
9 / 15
1 + 1* / 6
10 + 1* / 15
Files Wiped
N/A
I
Files Wiped
06/04/2021
4
4 / 4
N/A
4 / 4
No
C
C
07/04/2021
3
0 / 3
1 / 3
1 / 3
No
C: WV HMP
I: NPE
BSR: I
ASR: I
AGGRESSIVE
SETTINGS
IN
REAL-TIME​
MODULES
SEE
08/04/2021
1
1 / 1
N/A
1 / 1
No
C
C
09/04/2021
8
4 / 8
1* / 4
4 + 1* / 8
No
C: HMP
I: WV NPE
BSR: I
ASR: I
15/04/2021
3
1 / 3
2* / 2
1 + 2* / 3
No
C: WV NPE
I: NPE
P - NC
17/04/2021
5
2 / 3
0 / 3
2 / 5
No
C: WV NPE
I: NPE
BSR: I
ASR: I
18/04/2021
2
1 / 2
0 / 1
1 / 2
No
C: WV HMP
I: NPE
BSR: I
ASR: I
19/04/2021
2
0 / 2
1* / 2
1* / 2
No
C: HMP
I: WV NPE
BSR: I
ASR: I
20/04/2021
7
6 / 7
1 / 1
7 / 7
No
C
P
HIPS​
+​
FIREWALL​
TWEAKED RULES​
AGAINST​
RANSOMWARE​
23/04/2021
10
7 / 10
0 / 3
7 / 10
No
C: WV NPE
I: WV HMP
BSR: I
P - NC
25/04/2021
10
8 / 10
2 (H) / 2
8 + 2 (H) / 10
No
C
P
28/04/2021
6
3 / 6
3 (H) / 3
3 + 3 (H) / 6
No
C
P
29/04/2021
2
1 / 2
1 / 1
2 / 2
No
C
P
 
Last edited:

MacDefender

Level 16
Verified
Top Poster
Oct 13, 2019
779
It's nice to see ESET tested again! A lot of the same but some surprises too. As always, their signatures are excellent and the bulk of their protection. The only "dynamic" hits so far are due to signature detections in network-downloaded payloads or files (or file equivalents) that they staged being detected by signatures at runtime.

BazarLoader is a very interesting test case for two reasons:
  1. It's a reminder that even though ESET has had good track record with being one of the first to adding signatures and excellent mainstream AV testing results (borderline perfect track record), that doesn't mean it's 100% foolproof. This looks like EXE malware with a fairly high VT detection ratio getting through and infecting the system.
  2. It's once again a reminder that ESET is lacking in both its automatic HIPS configuration as well as a dynamic behavior blocker. Looking at the Huorong dynamic hit, the process is setting RunOnce and AutoRun registry keys, shelling out to cmd.exe, and is unsigned. I would be willing to bet that most behavior blockers would flip out about this happening, but ESET lets it right through without taking any action. Setting AutoRuns isn't even something that you need a dynamic injected behavior blocker to monitor -- this is something that I'd argue is the job of a HIPS system to flag.

I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.
 

blackice

Level 38
Verified
Top Poster
Well-known
Apr 1, 2019
2,730
I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.
I think one of the reasons they don't is that they worry about an increase in False Positives, and they have an obsession with keeping those low. Although we know other vendors manage to keep low FP with a good Behavior Blocker.
 

MacDefender

Level 16
Verified
Top Poster
Oct 13, 2019
779
I think one of the reasons they don't is that they worry about an increase in False Positives, and they have an obsession with keeping those low. Although we know other vendors manage to keep low FP with a good Behavior Blocker.
Yeah false positives and performance impact are both considerations. Also, it seems to me like most AVs that have a first party BB start de-prioritizing their signature quality (BitDefender being the classic example though they are not alone) because they assume their BB will do more of the heavy lifting.
 

upnorth

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Jul 27, 2015
5,457
I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.
Very possible, but personal I would lean my attention in that case to a much more unknown vendor like Ikarus :
that I see on many early detections. ESET is one of the " Top Dog " in that field, but as I also mentioned with other vendors, their strength, can also easy become their weakness. That's why the upcoming tests with tweaked settings will be extra interesting. Hopefully those results will improve.
 
L

Local Host

It's nice to see ESET tested again! A lot of the same but some surprises too. As always, their signatures are excellent and the bulk of their protection. The only "dynamic" hits so far are due to signature detections in network-downloaded payloads or files (or file equivalents) that they staged being detected by signatures at runtime.

BazarLoader is a very interesting test case for two reasons:
  1. It's a reminder that even though ESET has had good track record with being one of the first to adding signatures and excellent mainstream AV testing results (borderline perfect track record), that doesn't mean it's 100% foolproof. This looks like EXE malware with a fairly high VT detection ratio getting through and infecting the system.
  2. It's once again a reminder that ESET is lacking in both its automatic HIPS configuration as well as a dynamic behavior blocker. Looking at the Huorong dynamic hit, the process is setting RunOnce and AutoRun registry keys, shelling out to cmd.exe, and is unsigned. I would be willing to bet that most behavior blockers would flip out about this happening, but ESET lets it right through without taking any action. Setting AutoRuns isn't even something that you need a dynamic injected behavior blocker to monitor -- this is something that I'd argue is the job of a HIPS system to flag.

I really think if someone were to combine ESET's signatures with one of many decent behavior blockers, it would be a very strong product that rivals the best of the best.
This is actually a good show for people that claim ESET is properly setup out of the box, and that is set and forget.

ESET is not a bad AV, but is not for casual users, need to be properly configured and monitored.

It doesn't compare to the likes of Kaspersky which is actually set and forget.
 

Divine_Barakah

Level 29
Verified
Top Poster
Well-known
May 10, 2019
1,854
This is actually a good show for people that claim ESET is properly setup out of the box, and that is set and forget.

ESET is not a bad AV, but is not for casual users, need to be properly configured and monitored.

It doesn't compare to the likes of Kaspersky which is actually set and forget.
Well, I have to disagree here. Eset is more than enough for most users and the default settings are good enough at protecting the system. What are the chances of an average user getting hit by a zero day malware? Even if it happens, the malware would be detected by Eset after a short time and other users would be protected, so it is not a big deal.
 

upnorth

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Jul 27, 2015
5,457
It doesn't compare to the likes of Kaspersky
5ss-QM7-Ap-o.jpg
 

MacDefender

Level 16
Verified
Top Poster
Oct 13, 2019
779
Well, I have to disagree here. Eset is more than enough for most users and the default settings are good enough at protecting the system. What are the chances of an average user getting hit by a zero day malware? Even if it happens, the malware would be detected by Eset after a short time and other users would be protected, so it is not a big deal.
I think ESET's defaults are fairly sensible and for that product I think it is the way that most customers would want to run it. It is interesting though that ESET uniquely has a pretty powerful but untapped subsystem (HIPS) that is largely idle/unused by default except perhaps as a way to address major zero-day attacks that evade their signatures. With that said, configuring the HIPS properly requires both expertise and patience and, in my opinion, is not a practical choice for the average user who benefits from something like a behavior blocker. It is better suited for enterprise settings and servers which have a more static set of workflows so the user is less likely to hit a false positive from their HIPS ruleset.

The biggest benefit of a behavior blocker is not for stopping true zero day (entirely unknown) malware. It's that signature-specific behavior blocker detections are a great way of dealing with obfuscated malware and scriptors in particular. It's so easy to obfuscate that kind of malware that many of them do have automatic per-download obfuscation that is really hard to statically analyze. However, it's a lot harder for them to hide what they are trying to do when they run, which is why Kaspersky System Watcher and DeepGuard both contain detections for specific types of malware, not just general "oops you tried to register an AutoRun".

EDIT: With that said, in general ESET does a great job at using signatures and machine learning to solve this problem statically. In this particular case, I found it interesting that the way this malware evaded ESET's static detections would have been caught by a very basic behavior blocker.
 

blackice

Level 38
Verified
Top Poster
Well-known
Apr 1, 2019
2,730
I think ESET's defaults are fairly sensible and for that product I think it is the way that most customers would want to run it. It is interesting though that ESET uniquely has a pretty powerful but untapped subsystem (HIPS) that is largely idle/unused by default except perhaps as a way to address major zero-day attacks that evade their signatures. With that said, configuring the HIPS properly requires both expertise and patience and, in my opinion, is not a practical choice for the average user who benefits from something like a behavior blocker. It is better suited for enterprise settings and servers which have a more static set of workflows so the user is less likely to hit a false positive from their HIPS ruleset.

The biggest benefit of a behavior blocker is not for stopping true zero day (entirely unknown) malware. It's that signature-specific behavior blocker detections are a great way of dealing with obfuscated malware and scriptors in particular. It's so easy to obfuscate that kind of malware that many of them do have automatic per-download obfuscation that is really hard to statically analyze. However, it's a lot harder for them to hide what they are trying to do when they run, which is why Kaspersky System Watcher and DeepGuard both contain detections for specific types of malware, not just general "oops you tried to register an AutoRun".

EDIT: With that said, in general ESET does a great job at using signatures and machine learning to solve this problem statically. In this particular case, I found it interesting that the way this malware evaded ESET's static detections would have been caught by a very basic behavior blocker.
I agree. I think it is well setup for a good balance. Would I recommend it for a happy clicker with low tech knowledge? No. But I’d recommend it to anyone with decent basic internet hygiene. Of course I’d say that about Microsoft Defender as well. It’s not the best in terms of protection as we see in the hub, but far from the worst. It is one of the best for usability for many people.
 

Minimalist

Level 9
Verified
Well-known
Oct 2, 2020
439
ESET's HIPS on it's own probably won't block much. That's why they've published HIPS rules that administrators can set up in organisation to prevent some ransomware attack scenarios: [KB6119] Configure HIPS rules for ESET business products to protect against ransomware
They've also published firewall rules for similar purpose: [KB6132] Configure firewall rules for ESET Endpoint Security to protect against ransomware

Most users of course won't be able to set this up. But they most likely won't encounter zero day if they practice safe computing. If they still get hit by one, they would probably have better chances with Kaspersky or some other solution with good BB.
 

Zorro

Level 9
Verified
Well-known
Jun 11, 2019
404
Hello. When you set up hips, then write down these registry keys :) This was recommended to me by a familiar user. The action is to ask the user.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\*
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath
Antivirus developers also advise a whole list for protection. support.eset.com/en/kb6119-configure-hips-rules-for-eset-business-products-to-protect-against-ransomware
 
F

ForgottenSeer 72227

The_King

Level 12
Verified
Top Poster
Well-known
Aug 2, 2020
542

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top