Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 934886" data-attributes="member: 86910">[USER=91050]LaurentG[/USER] I can submit the sample to Defender if you agree.I think we both mean the same but have different understanding on terminology.A behaviour based detection for me is one, whose rules are based on behaviour of the sample. E.g., the rule will say: If something downloads a file, puts it to autorun and executes it, this behaviour is defined as malicious. In order for this to work all of these steps until execution will also be done by the sample. This may lead to, e.g., anti-ransomware protection rule only detecting a malware after it has already encrypted some files.What you probably refer to is that the sample needs to be executed in order for AMSI to work. We call this part dynamic (static is the counterpart with no execution involved). The sample is executed but the detection signatures on them are not behaviour based because they don&#039;t care what the sample does. All they care about is the deobfuscated content in memory. These are usually just patterns and they are applied the same to AMSI streams as static signature patterns.It won&#039;t work for hash based allowlisting. There are different ways to allowlist a file, though. Among others, signatures can be applied. They work just as any other signature on the deobfuscated content, but detect a clean file instead of malicious ones.</blockquote>

[QUOTE="struppigel, post: 934886, member: 86910"] [USER=91050]LaurentG[/USER] I can submit the sample to Defender if you agree. I think we both mean the same but have different understanding on terminology. A behaviour based detection for me is one, whose rules are based on behaviour of the sample. E.g., the rule will say: If something downloads a file, puts it to autorun and executes it, this behaviour is defined as malicious. In order for this to work all of these steps until execution will also be done by the sample. This may lead to, e.g., anti-ransomware protection rule only detecting a malware after it has already encrypted some files. What you probably refer to is that the sample needs to be executed in order for AMSI to work. We call this part dynamic (static is the counterpart with no execution involved). The sample is executed but the detection signatures on them are not behaviour based because they don't care what the sample does. All they care about is the deobfuscated content in memory. These are usually just patterns and they are applied the same to AMSI streams as static signature patterns. It won't work for hash based allowlisting. There are different ways to allowlist a file, though. Among others, signatures can be applied. They work just as any other signature on the deobfuscated content, but detect a clean file instead of malicious ones. [/QUOTE]

Verification