Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1117922" data-attributes="member: 32260">Microsoft Defender and Kaspersky have excellent behavioral detection based on Machine Learning models. So why Kaspersky AV can score better in Real-World tests?[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/the-best-home-av-2023-2024-av-test-av-comparatives.134865/post-1117751[/URL]The answer is probably included in the video:[MEDIA=youtube]qmKa2_eITIY[/MEDIA]As we can see, some FUDs (Fully UnDetectable malware) are detected only after the execution, when some malicious actions are already done. Microsoft decided to fight such malware as follows:<ol>
<li data-xf-list-type="ol">Enabled SmartScreen (in Edge and for Windows Explorer).</li>
<li data-xf-list-type="ol">Enabled ASR rules (especially the rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criteria&quot;).</li>
<li data-xf-list-type="ol">Post-execution behavioral detection.</li>
</ol>If the user has enabled SmartScreen, the FUDs are mainly blocked, so there is no visible difference between Microsoft Defender (MD) and top AVs.If SmartScreen is disabled or the user ignores SmartScreen alerts, enabling advanced settings in MD is necessary to prevent efficiently FUDs. If not, then MD uses post-execution behavioral detection which is as good as for Kaspersky, but Kaspersky can efficiently reverse the changes made by the Malware (like encrypted files), and MD often cannot.Edit.One could ask: Can such MD post-execution protection be useful?Yes, it can (although imperfect). The first victim is infected, but others will be protected in a few minutes.</blockquote>

[QUOTE="Andy Ful, post: 1117922, member: 32260"] Microsoft Defender and Kaspersky have excellent behavioral detection based on Machine Learning models. So why Kaspersky AV can score better in Real-World tests? [URL unfurl="false"]https://malwaretips.com/threads/the-best-home-av-2023-2024-av-test-av-comparatives.134865/post-1117751[/URL] The answer is probably included in the video: [MEDIA=youtube]qmKa2_eITIY[/MEDIA] As we can see, some FUDs (Fully UnDetectable malware) are detected only after the execution, when some malicious actions are already done. Microsoft decided to fight such malware as follows: [LIST=1] [*]Enabled SmartScreen (in Edge and for Windows Explorer). [*]Enabled ASR rules (especially the rule "Block executable files from running unless they meet a prevalence, age, or trusted list criteria"). [*]Post-execution behavioral detection. [/LIST] If the user has enabled SmartScreen, the FUDs are mainly blocked, so there is no visible difference between Microsoft Defender (MD) and top AVs. If SmartScreen is disabled or the user ignores SmartScreen alerts, enabling advanced settings in MD is necessary to prevent efficiently FUDs. If not, then MD uses post-execution behavioral detection which is as good as for Kaspersky, but [B][COLOR=rgb(0, 168, 133)]Kaspersky can efficiently reverse the changes made by the Malware (like encrypted files),[/COLOR][/B] [COLOR=rgb(184, 49, 47)][B]and MD often cannot.[/B][/COLOR] [B]Edit.[/B] One could ask: Can such MD post-execution protection be useful? Yes, it can (although imperfect). The first victim is infected, but others will be protected in a few minutes. [/QUOTE]

Verification