Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 977860" data-attributes="member: 32260">AVLab testing is special. It shows things about AVs that cannot be seen in other tests. But, this also makes AVLab tests hard to correctly interpret.For example, except for AVLab, only Malware Hub could mimic the behavior of Defender (and probably other AVs) against lateral movement. Other tests are based on a few custom samples, so they are not convincing. The categorization of the Levels 1,2,3 in AVLab is interesting and valuable. AVLab also shows that chances of infection by a few days old malware is very low.Another innovative approach can be visible in MRG Effitas that uses such categories as &quot;Behaviour block&quot;/ &quot;Auto block&quot;, and &quot;Blocked in 24 hours&quot;. The category &quot;Blocked in 24 hours&quot; can mimic the post-infection features of the AVs. Of course, there is no perfect testing methodology and the results are usually misunderstood by readers. The common mistake is comparing the results of Real-World tests with Malware Protection tests or ignoring the random factor in the test results.Edit.According to MRG Effitas tests (from the year 2021) the AV which uses most frequently the behavior blocks is AVira. The &quot;Behavior block&quot; is similar to Level 3:It is most visible in the latest test:[URL unfurl=&quot;true&quot;]https://www.mrg-effitas.com/wp-content/uploads/2022/02/MRG_Effitas_360_Q4_2021.pdf[/URL]Security Applications Tested •<ul>
<li data-xf-list-type="ul">Avast Business Antivirus 21.11.2683</li>
<li data-xf-list-type="ul">Avira Antivirus Pro 1.1.51.20724</li>
<li data-xf-list-type="ul">Bitdefender Endpoint Security 7.4.2.130</li>
<li data-xf-list-type="ul">ESET Endpoint Security 8.1.2037.2</li>
<li data-xf-list-type="ul">F-Secure Computer Protection Premium 21.10</li>
<li data-xf-list-type="ul">Malwarebytes Endpoint Protection 1.2.0.954</li>
<li data-xf-list-type="ul">Microsoft Windows Defender 4.18.2111.5</li>
<li data-xf-list-type="ul">Symantec Endpoint Protection 14.3.5413.3000</li>
<li data-xf-list-type="ul">Trend Micro Security 6.7.1560/14.2.1310</li>
</ul></blockquote>

[QUOTE="Andy Ful, post: 977860, member: 32260"] AVLab testing is special. It shows things about AVs that cannot be seen in other tests. But, this also makes AVLab tests hard to correctly interpret. For example, except for AVLab, only Malware Hub could mimic the behavior of Defender (and probably other AVs) against lateral movement. Other tests are based on a few custom samples, so they are not convincing. The categorization of the Levels 1,2,3 in AVLab is interesting and valuable. AVLab also shows that chances of infection by a few days old malware is very low. Another innovative approach can be visible in MRG Effitas that uses such categories as "Behaviour block"/ "Auto block", and "Blocked in 24 hours". The category "Blocked in 24 hours" can mimic the post-infection features of the AVs. Of course, there is no perfect testing methodology and the results are usually misunderstood by readers. The common mistake is comparing the results of Real-World tests with Malware Protection tests or ignoring the random factor in the test results. Edit. According to MRG Effitas tests (from the year 2021) the AV which uses most frequently the behavior blocks is AVira. The "Behavior block" is similar to Level 3: It is most visible in the latest test: [URL unfurl="true"]https://www.mrg-effitas.com/wp-content/uploads/2022/02/MRG_Effitas_360_Q4_2021.pdf[/URL] Security Applications Tested • [LIST] [*]Avast Business Antivirus 21.11.2683 [*]Avira Antivirus Pro 1.1.51.20724 [*]Bitdefender Endpoint Security 7.4.2.130 [*]ESET Endpoint Security 8.1.2037.2 [*]F-Secure Computer Protection Premium 21.10 [*]Malwarebytes Endpoint Protection 1.2.0.954 [*]Microsoft Windows Defender 4.18.2111.5 [*]Symantec Endpoint Protection 14.3.5413.3000 [*]Trend Micro Security 6.7.1560/14.2.1310 [/LIST] [/QUOTE]

Verification