Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 997750" data-attributes="member: 83059">I find DeepGuard tends to declare something suspicious often times before even one file gets encrypted. If it&#039;s a good exploit, maybe some files.I feel less comfortable with the System Watching approach of &quot;hey go do your thing, I&#039;ll roll things back later&quot; if anything. The more time you let malware run, the more things it can do which you&#039;ll either fail to roll back or can&#039;t roll back. For example, there&#039;s no rolling back of extortionware when it steals your files before encrypting them.Again, DeepGuard tends to be sensitive and prone to false positives if you routinely deal with unknown PE files. KSW is much less prone to false positives. It is also an extremely extremely effective behavior blocker. Not giving a preference.(addressing these together): [USER=38832]@upnorth[/USER] I definitely admit this is purely a guess as an observer and an observation from 1-2 months ago, as I haven&#039;t recently been able to keep up with trends. I also am fairly confident of this pattern when it comes to PE malware on abuse.ch in particular. Some of the blacklisted samples I&#039;ve looked at on abch were legit software that happened to trigger a sandbox heuristic and if there was any human inspection of the sandbox result, it would not have been marked as malware. Personally, I think this technique is pretty effective against zero-days, my concern is mostly it biases some casual malware testing results. Of course the experts don&#039;t just get samples from Abuse.ch but a lot of the Youtube videos I&#039;m watching, the samples do appear to basically be scraped from a public sandbox. It could make the results seem misleadingly good.</blockquote>

[QUOTE="MacDefender, post: 997750, member: 83059"] I find DeepGuard tends to declare something suspicious often times before even one file gets encrypted. If it's a good exploit, maybe some files. I feel [I]less[/I] comfortable with the System Watching approach of "hey go do your thing, I'll roll things back later" if anything. The more time you let malware run, the more things it can do which you'll either fail to roll back or can't roll back. For example, there's no rolling back of extortionware when it steals your files before encrypting them. Again, DeepGuard tends to be sensitive and prone to false positives if you routinely deal with unknown PE files. KSW is much less prone to false positives. It is also an extremely extremely effective behavior blocker. Not giving a preference. (addressing these together): [USER=38832]@upnorth[/USER] I definitely admit this is purely a guess as an observer and an observation from 1-2 months ago, as I haven't recently been able to keep up with trends. I also am fairly confident of this pattern when it comes to PE malware on abuse.ch in particular. Some of the blacklisted samples I've looked at on abch were legit software that happened to trigger a sandbox heuristic and if there was any human inspection of the sandbox result, it would not have been marked as malware. Personally, I think this technique is pretty effective against zero-days, my concern is mostly it biases some casual malware testing results. Of course the experts don't [I]just[/I] get samples from Abuse.ch but a lot of the Youtube videos I'm watching, the samples do appear to basically be scraped from a public sandbox. It could make the results seem misleadingly good. [/QUOTE]

Verification