Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 890988" data-attributes="member: 32260">Interesting ransomware was tested on MH:[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/fud-netwalker-ransomware-ps1-20-06-2020.101973/#post-890953[/URL]This example shows two things:<ol>
<li data-xf-list-type="ol">Even the AV with ATP cannot detect all scripting attacks.</li>
<li data-xf-list-type="ol">There is a big difference between malware tests and real-world tests.</li>
</ol>The first point is evident from the Malware Hub results. So, the best method is still blocking scripts in UserSpace.The second point follows from the fact that in the real world attack, the attacker will not use a PowerShell script as the initial infection vector due to the PowerShell Execution Policy. So, the MS Office document, shortcut, or another infection vector will be used to run the PowerShell script and bypass the PowerShell Execution Policy. In most cases, also the phishing link will be used. This will change the detection significantly for all AVs with ATP. For example, the WD ASR rules will block such attacks performed via exploiting MS Office or Adobe Reader applications.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 890988, member: 32260"] Interesting ransomware was tested on MH: [URL unfurl="true"]https://malwaretips.com/threads/fud-netwalker-ransomware-ps1-20-06-2020.101973/#post-890953[/URL] This example shows two things: [LIST=1] [*]Even the AV with ATP cannot detect all scripting attacks. [*]There is a big difference between malware tests and real-world tests. [/LIST] The first point is evident from the Malware Hub results. So, the best method is still blocking scripts in UserSpace. The second point follows from the fact that in the real world attack, the attacker will not use a PowerShell script as the initial infection vector due to the PowerShell Execution Policy. So, the MS Office document, shortcut, or another infection vector will be used to run the PowerShell script and bypass the PowerShell Execution Policy. In most cases, also the phishing link will be used. This will change the detection significantly for all AVs with ATP. For example, the WD ASR rules will block such attacks performed via exploiting MS Office or Adobe Reader applications.(y) [/QUOTE]

Verification