Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 944644" data-attributes="member: 32260">Bearing in mind that Cylance does not detect scripts, it seems that you can test it in two scenarios: Cylance alone and with SWH (similar tests were done on MH for some AVs with SysHardener). Comparing the results of both could be interesting, because in some cases, the initial EXE malware might use scripts in the infection chain. Of course, two testing scenarios will make the testing procedure more complex and time-consuming.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />EditIf the impact of SWH on the detection of PE files will be visible, then I can consider adding the enforcement for &#039;All users&#039; to SWH. For now, I think that adding it is questionable. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /></blockquote>

[QUOTE="Andy Ful, post: 944644, member: 32260"] Bearing in mind that Cylance does not detect scripts, it seems that you can test it in two scenarios: Cylance alone and with SWH (similar tests were done on MH for some AVs with SysHardener). Comparing the results of both could be interesting, because in some cases, the initial EXE malware might use scripts in the infection chain. Of course, two testing scenarios will make the testing procedure more complex and time-consuming.:( Edit If the impact of SWH on the detection of PE files will be visible, then I can consider adding the enforcement for 'All users' to SWH. For now, I think that adding it is questionable. :unsure: [/QUOTE]

Verification