Serious Discussion Malwarebytes proving to be a disappointment

[Khushal]

this should be a reminder to everybody on this planet that the best antivirus is common sense.

Obviously this isn't just a Malwarebytes hate post but also condemning every antivirus that people pay for.

I just happen to be a paying member of Malwarebytes and if my money can't detect obvious script kiddie virus I wonder if it's even worth paying for continuously

Source:

https://www.reddit.com/r/antivirus/comments/1s6o3ip/malwarebytes_proving_to_be_a_disappointment/

 

[LinuxFan58]

Mhh anyone who tells you that the best antivirus is common sense, should be told that common sense tells that scripts should be blocked in user folders and lolbins should be blocked for standard user (in other words use SWH) besides your antivirus (being Avast Free of MBAM paid). I really don't see a use case for allowing these Microsoft business use misfits to run in home user setting.

 

[Sorrento]

I don't know if its me or not but there don't seem to be any content????

 

[Parkinsond]

common sense tells that scripts should be blocked in user folders and lolbins should be blocked for standard user

I would call it "common knowledge".

 

[TairikuOkami]

I do not particularly like Malwarebytes, but not sure what the author of the article is trying to say? AV failed to detect 1 virus, listed on github, so even missed by MS.

It tries to use PowerShell, easily blocked by policies or restrictions.



It tries to use DNS via UDP port 53 hosted on Cloudflare, again basic DNS security. Plus the link is blocked via malware filters or DNS.



Sure, AV failed to block it, but is like antibiotics, it should be used as the last resort. Malwarebytes is not exactly the best AV in behavioral detection, so it is to be expected.

P.S. I am glad, that System Informer still is not well known and that the name matters, if you would rename process monitor as cookie.exe, it would be undetected.

badProcesses = [
                    'vmtoolsd.exe', 'vmwaretray.exe', 'vmwareuser.exe', 'vboxservice.exe', 'vboxtray.exe',
                    'wireshark.exe', 'fiddler.exe', 'procmon.exe', 'procexp.exe',
                    'x64dbg.exe', 'x32dbg.exe', 'ida.exe', 'ida64.exe', 'ollydbg.exe', 'windbg.exe',
                    'joeboxserver.exe', 'cuckoomon.exe'

It uses fodhelper and sdclt as lolbins, time to add them to my collection.

 

[Parkinsond]

Scripts are tricky and most AVs do not detect pre-execution based on signature.
Either blocked on-execution by SRP/CLM or post-execution by behavioral analysis/firewall.
The success depends on how fast the behavioral analysis will react.

 

[harlan4096]

 

[TuxTalk]

 

[Parkinsond]

 

[Parkinsond]

View attachment 296700 View attachment 296701

Payload chances of being detected is higher, but not the script downloading the payload.