Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 937463" data-attributes="member: 83059">I think ESET&#039;s defaults are fairly sensible and for that product I think it is the way that most customers would want to run it. It is interesting though that ESET uniquely has a pretty powerful but untapped subsystem (HIPS) that is largely idle/unused by default except perhaps as a way to address major zero-day attacks that evade their signatures. With that said, configuring the HIPS properly requires both expertise and patience and, in my opinion, is not a practical choice for the average user who benefits from something like a behavior blocker. It is better suited for enterprise settings and servers which have a more static set of workflows so the user is less likely to hit a false positive from their HIPS ruleset.The biggest benefit of a behavior blocker is not for stopping true zero day (entirely unknown) malware. It&#039;s that signature-specific behavior blocker detections are a great way of dealing with obfuscated malware and scriptors in particular. It&#039;s so easy to obfuscate that kind of malware that many of them do have automatic per-download obfuscation that is really hard to statically analyze. However, it&#039;s a lot harder for them to hide what they are trying to do when they run, which is why Kaspersky System Watcher and DeepGuard both contain detections for specific types of malware, not just general &quot;oops you tried to register an AutoRun&quot;.EDIT: With that said, in general ESET does a great job at using signatures and machine learning to solve this problem statically. In this particular case, I found it interesting that the way this malware evaded ESET&#039;s static detections would have been caught by a very basic behavior blocker.</blockquote>

[QUOTE="MacDefender, post: 937463, member: 83059"] I think ESET's defaults are fairly sensible and for that product I think it is the way that most customers would want to run it. It is interesting though that ESET uniquely has a pretty powerful but untapped subsystem (HIPS) that is largely idle/unused by default except perhaps as a way to address major zero-day attacks that evade their signatures. With that said, configuring the HIPS properly requires both expertise and patience and, in my opinion, is not a practical choice for the average user who benefits from something like a behavior blocker. It is better suited for enterprise settings and servers which have a more static set of workflows so the user is less likely to hit a false positive from their HIPS ruleset. The biggest benefit of a behavior blocker is not for stopping true zero day (entirely unknown) malware. It's that signature-specific behavior blocker detections are a great way of dealing with obfuscated malware and scriptors in particular. It's so easy to obfuscate that kind of malware that many of them do have automatic per-download obfuscation that is really hard to statically analyze. However, it's a lot harder for them to hide what they are trying to do when they run, which is why Kaspersky System Watcher and DeepGuard both contain detections for specific types of malware, not just general "oops you tried to register an AutoRun". EDIT: With that said, in general ESET does a great job at using signatures and machine learning to solve this problem statically. In this particular case, I found it interesting that the way this malware evaded ESET's static detections would have been caught by a very basic behavior blocker. [/QUOTE]

Verification