Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 849976" data-attributes="member: 32260">MS says not:&quot;Since deployment, the behavior-based machine learning models have blocked attacker techniques like the following used by attacks in the wild:<ul>
<li data-xf-list-type="ul">Credential dumping from LSASS</li>
<li data-xf-list-type="ul">Cross-process injection</li>
<li data-xf-list-type="ul">Process hollowing</li>
<li data-xf-list-type="ul">UAC bypass</li>
<li data-xf-list-type="ul">Tampering with antivirus (such as disabling it or adding the malware as exclusion)</li>
<li data-xf-list-type="ul">Contacting C&amp;C to download payloads</li>
<li data-xf-list-type="ul">Coin mining</li>
<li data-xf-list-type="ul">Boot record modification</li>
<li data-xf-list-type="ul">Pass-the-hash attacks</li>
<li data-xf-list-type="ul">Installation of root certificate</li>
<li data-xf-list-type="ul">Exploitation attempt for various vulnerabilities&quot;</li>
</ul><a href="https://www.microsoft.com/security/blog/2019/10/08/in-hot-pursuit-of-elusive-threats-ai-driven-behavior-based-blocking-stops-attacks-in-their-tracks/" target="_blank">In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks - Microsoft Security</a> But, the malware with Acronis certificate could probably bypass such detection.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 849976, member: 32260"] MS says not: [I]"Since deployment, the behavior-based machine learning models have blocked attacker techniques like the following used by attacks in the wild:[/I] [LIST] [*][I]Credential dumping from LSASS[/I] [*][I]Cross-process injection[/I] [*][I]Process hollowing[/I] [*][I]UAC bypass[/I] [*][I]Tampering with antivirus (such as disabling it or [COLOR=rgb(184, 49, 47)][B]adding the malware as exclusion[/B][/COLOR])[/I] [*][I]Contacting C&C to download payloads[/I] [*][I]Coin mining[/I] [*][I]Boot record modification[/I] [*][I]Pass-the-hash attacks[/I] [*][I]Installation of root certificate[/I] [*][I]Exploitation attempt for various vulnerabilities"[/I] [/LIST] [URL="https://www.microsoft.com/security/blog/2019/10/08/in-hot-pursuit-of-elusive-threats-ai-driven-behavior-based-blocking-stops-attacks-in-their-tracks/"]In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks - Microsoft Security[/URL] But, the malware with Acronis certificate could probably bypass such detection.(y) [/QUOTE]

Verification