Reply to thread

Message

<blockquote data-quote="ForgottenSeer 103564" data-source="post: 1061822">Seems legit! Im sure everyone slams their system with 100 malicious links at once via a python script when they do get infected, you know, the go big or go home effect, the whole operating system was screaming for mercy, that little squeaking noise i heard in my speakers. On a serious note, if you are going to test something like this, wouldnt it be better to test one sample at a time, using analysis tools watching in real time anything that made it past the defenses, where it did, how it did, ect. One could learn more from that than this 1 in a million chances of happening kind of infection.Edit: I guess i should specify. When a sample drops onto the system or is executed on the system, using more than just one tool to see a process was started is helpful. Autoruns for example, did the malicious item create a start up entry, tcpview after dropping or executing on the system did it call out and drop other items onto the system. Where in user space did it drop and anchor itself, how did the tested product handle these individual aspects/stages, you know, useful information. This type of testing method above is really no different than the old right click context scan method, it is pointless.</blockquote>

[QUOTE="ForgottenSeer 103564, post: 1061822"] Seems legit! Im sure everyone slams their system with 100 malicious links at once via a python script when they do get infected, you know, the go big or go home effect, the whole operating system was screaming for mercy, that little squeaking noise i heard in my speakers. On a serious note, if you are going to test something like this, wouldnt it be better to test one sample at a time, using analysis tools watching in real time anything that made it past the defenses, where it did, how it did, ect. One could learn more from that than this 1 in a million chances of happening kind of infection. Edit: I guess i should specify. When a sample drops onto the system or is executed on the system, using more than just one tool to see a process was started is helpful. Autoruns for example, did the malicious item create a start up entry, tcpview after dropping or executing on the system did it call out and drop other items onto the system. Where in user space did it drop and anchor itself, how did the tested product handle these individual aspects/stages, you know, useful information. This type of testing method above is really no different than the old right click context scan method, it is pointless. [/QUOTE]

Verification