Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 977878" data-attributes="member: 32260">The best results in Malware Protection tests or in any test that includes only PE files (EXE, DLL, etc.) will get the AVs that use file reputation lookup. This is rare when AVs are tested on default settings (Comodo, Norton, Emsisoft).But several AVs can use it after some tweaks (Avast, AVG, Defender, Kaspersky Internet Security).Avast and AVG can use Hardened Mode. KIS can be configured to highly restrict the files unknown to KSN.In Defender, this can work most often via one of the ASR rules. But, the strongest solution would be ISG (Intelligence Security Graph) option in Microsoft Defender Application Control (MDAC), which can be also applied on Windows 10 Home. The disadvantage of this solution is that Windows PRO/Enterprise is needed to create/manage the policy file + many false positives (software auto-updates must be disabled). Anyway, Microsoft recommends it in Enterprises. The false positives issue can be solved by submitting software installers/updaters to Microsoft. The false positives are usually removed in one day.Edit.It is worth knowing that file reputation lookup can be bypassed via DLL hijacking when file reputation is narrowed to EXE files (DLLs not included). So, the strongest solutions have to include also PE libraries (Comodo, Kaspersky, Defender ISG). Norton includes DLLs only if they are downloaded from the Internet or USB drives.</blockquote>

[QUOTE="Andy Ful, post: 977878, member: 32260"] The best results in Malware Protection tests or in any test that includes only PE files (EXE, DLL, etc.) will get the AVs that use file reputation lookup. This is rare when AVs are tested on default settings (Comodo, Norton, Emsisoft). [B]But several AVs can use it after some tweaks (Avast, AVG, Defender, Kaspersky Internet Security).[/B] Avast and AVG can use Hardened Mode. KIS can be configured to highly restrict the files unknown to KSN. In Defender, this can work most often via one of the ASR rules. But, the strongest solution would be ISG (Intelligence Security Graph) option in Microsoft Defender Application Control (MDAC), which can be also applied on Windows 10 Home. The disadvantage of this solution is that Windows PRO/Enterprise is needed to create/manage the policy file + many false positives (software auto-updates must be disabled). Anyway, Microsoft recommends it in Enterprises. The false positives issue can be solved by submitting software installers/updaters to Microsoft. The false positives are usually removed in one day. Edit. It is worth knowing that file reputation lookup can be bypassed via DLL hijacking when file reputation is narrowed to EXE files (DLLs not included). So, the strongest solutions have to include also PE libraries (Comodo, Kaspersky, Defender ISG). Norton includes DLLs only if they are downloaded from the Internet or USB drives. [/QUOTE]

Verification