MRG Effitas MRG Effitas 360 Degree Assessment & Certification Q4 2020

[James246]

Could you give us the source of the above information? I still doubt that these features are fully implemented.
I also noticed that the Nebula Console has the ability to change the Malwarebytes Policies and can load several profiles. Although one test means nothing, the Malwarebytes Endpoint Protection got perfect scoring in MRG Effitas which is in clear contradiction with many other tests for MB.
As you know Defender free has got also the core technology of the full product. Simply some features cannot be configured from Security Center and some are available only via Enterprise Licences.
So using the Katana engine in MB and in Endpoint Protection can be different.

I am also interested in knowing if there are any differences in the core technology of the Malwarebytes - persona;;y I suspect there isn't - perhaps this result is a one off anomaly.

 

[Nightwalker]

Could you give us the source of the above information? I still doubt that these features are fully implemented.
I also noticed that the Nebula Console has the ability to change the Malwarebytes Policies and can load several profiles. Although one test means nothing, the Malwarebytes Endpoint Protection got perfect scoring in MRG Effitas which is in clear contradiction with many other tests for MB.
As you know Defender free has got also the core technology of the full product. Simply some features cannot be configured from Security Center and some are available only via Enterprise Licences.
So using the Katana engine in MB and in Endpoint Protection can be different.

The source is the blog, the official forum with years and years of changelogs of the beta + release versions and the Staff comments, so if one is actually involved with it can see clearly how their technology is implemented; they still keep beta versions of standalone modules like Anti Exploit and Anti Ransomware just to port the technology for Malwarebytes Premium and them for the Endpoint Protection.

Example:

Latest version of MBARW Beta v0.9.20 - 1.1.491 released 17 Aug 2023

Hello, The latest version of Malwarebytes Anti-Ransomware - Beta 11 (version 0.9.20) is now available for download. VERY IMPORTANT!!: Malwarebytes 3/4 and MBARW - It is actually not possible to run the free version of Malwarebytes 3/4 and the standalone Anti-Ransomware Beta side-by-side, as they ...

forums.malwarebytes.com

Malwarebytes Anti-Exploit 1.13 Build 585 released - Feb 8, 2024

We're happy to announce the release of Malwarebytes Anti-Exploit Beta 1.13 Build 585. This is a full Beta version with premium features available to Free users: Download this Release version here Malwarebytes Anti-Exploit 1.13.1.585 Stability/issues fixed: Fixed issues with Chrome browser Fixed f...

forums.malwarebytes.com

All the protection features are ported from those standalone betas modules to Malwarebytes Premium (consumer) and them the stable release of Malwarebytes Premium becomes the Endpoint Protection.

https://www.malwarebytes.com/pdf/guides/MBAEBGuide.pdf (take a look of this old Malwarebytes Anti Exploit features)

There is no tweak or downgrade of those technologies while ported to Malwarebytes Premium, in the same sense there is no "upgrade" or more advanced features in the enterprise versions, save for the Response Module and the cloud management.

Your argument about those features being not fully implemented in the consumer version is just a speculation, I dont want to search for literally years of posts, so if you dont believe in my word and my experience with their products you can just ask in their forums.

Their technology:
Why Choose Malwarebytes | Malwarebytes

Announcing Malwarebytes 4.0: smarter, faster, and lighter | Malwarebytes Labs

Malwarebytes 4.0 not only sports a whole new look, but packs cutting-edge detection methods into a lightweight, lightning-fast program.

blog.malwarebytes.com

Announcing Malwarebytes 3.0, a next-generation antivirus replacement | Malwarebytes Labs

Announcing the launch of our next-generation online security product, Malwarebytes 3.0! You can finally replace your traditional antivirus software.

blog.malwarebytes.com

https://support.malwarebytes.com/hc/en-us/article_attachments/360052630513/Endpoint_Security_Quick_Start_Guide.pdf

TLDR: Malwarebytes Endpoint Protection is Malwarebytes Premium + Console

 

[Venustus]

Two surprises here,the low score for Symantec and the high score for MB

 

[Andy Ful]

...
Your argument about those features being not fully implemented in the consumer version is just a speculation, I dont want to search for literally years of posts, so if you dont believe in my word and my experience with their products you can just ask in their forums.

I do not say that you must be wrong. Anyway, there is a reasonable doubt, because several vendors do it. But my primary hesitation is related to the disproportion in MB scorings between the MRG Effitas test and other tests. Something like a comparison of features between different MB versions would help, but I could not find any.

By the way, Nebula uses cloud sandbox to investigate unknown threats. Does MB use this feature?

 

[Nightwalker]

It is reasonable doubt, because several vendors do it. By the way, Nebula uses cloud sandbox investigations for unknown threats. Does MB use this feature?

Not applicable in this test, this feature is for malware remediation, not prevention and this isnt the scope of the test and that wasnt the product that was tested.


Here the difference:

Endpoint Security Products - ThreatDown by Malwarebytes

ThreatDown’s endpoint security products combine award-winning technology solutions and the skilled services needed to simplify threat protection.

www.malwarebytes.com

Malwarebytes Endpoint Protection for Business (the product that was actually tested)
Malwarebytes Endpoint Detection and Response for Business (The endpoint protection plus "Response" module).

 

[Nightwater]

Guys, don't take this test as an absolute truth, it's just a test like those of AV TEST, AV-Comparatives and etc, all questionable, and always.. always take it like a grain of salt, If there’s anything we can trust, it’s on the site’s hub

 

[blackice]

Guys, don't take this test as an absolute truth, it's just a test like those of AV TEST, AV-Comparatives and etc, all questionable, and always.. always take it like a grain of salt, If there’s anything we can trust, it’s on the site’s hub

Maybe we need to ask @harlan4096 kindly to test Malwarebytes Premium (I can help with a license if necessary) next.

 

[Andy Ful]

Not applicable in this test, this feature is for malware remediation, not prevention and this isnt the scope of the test and that wasnt the product that was tested.

Yes. I found the comparison of these two versions:

https://resources.malwarebytes.com/files/2018/11/181129-MWB-Product-Comparison-Guide-v9.pdf

So, it seems that we cannot explain for now the perfect scoring in the MRG Effitas test.

 

[Andy Ful]

Guys, don't take this test as an absolute truth, it's just a test like those of AV TEST, AV-Comparatives and etc, all questionable, and always.. always take it like a grain of salt, If there’s anything we can trust, it’s on the site’s hub

You are talking to guys who are already very suspicious:

AV-Comparatives - Randomness in the AV Labs testing.

Let's consider the example of the initial pule of 30000 sufficiently different malware variants in the wild and the particular AV which failed to detect 100 of them. Next, we make for the above results a trial to choose 380 samples from these 30000 and calculate the probabilities for finding in...

malwaretips.com

Simply, such a perfect result in many different categories would not be especially probable for MB Premium even in a single test.

 

[Nightwalker]

@Andy Ful

Malwarebytes staff finally answered you.

MB version differences

Hi, Is there any difference between MB Premium and MB Endpoint Protection except the features related strictly to Nebula Platform? It seems that MB Endpoint Protection started to participate in MRG Effitas tests and scored perfectly in all categories: In the Wild 360, Ransomware, Financial, PUA/A...

forums.malwarebytes.com

 

[Andy Ful]

@AlexSmith (Technical Product Manager) answered:

"Outside of the Nebula platform specific features, Malwarebytes Endpoint Protection is the technical equivalent to Malwarebytes Premium."

I am not sure if these platform specific features can explain the disproportion of testing results. So, we should wait for more tests.
I have invited @AlexSmith to post here about MB protection.
https://forums.malwarebytes.com/topic/271328-mb-version-differences/?do=findComment&comment=1442775

 

[James246]

@AlexSmith (Technical Product Manager) answered:

"Outside of the Nebula platform specific features, Malwarebytes Endpoint Protection is the technical equivalent to Malwarebytes Premium."

I have invited him to post here about MB protection.
https://forums.malwarebytes.com/topic/271328-mb-version-differences/?do=findComment&comment=1442775

So either Malwarebytes has made some kind of breakthrough or the result is a one off ( the latter is probably more likely though the former would be preferred )

 

[Andy Ful]

So either Malwarebytes has made some kind of breakthrough or the result is a one off ( the latter is probably more likely though the former would be preferred )

Let's wait for more information.

 

[pbust]

Hi, was pointed to this post. Pedro Bustamante here, head of research and innovation at malwarebytes... excuse the old Panda icon

I can confirm both the MB4core and corporate EP core detection is exactly the same. We do have a separate EDR business product that includes a few more cloud-based detection technologies, but that was not tested at MRG. The bad performance rating was a config error on our part as we provisioned EDR instead of EP (even though the EDR detections don't count for points in the MRG test). In the next test you'll see the real performance impact comparative.

In terms of participating and focusing on 3rd party tests, we made the decision about a year ago to focus on improving in these tests. The launch of Katana by incorporating a few more static (sig and heuristic) and dynamic (runtime sandbox) engine layers has helped bridge the historic gap. During the process we found and fixed bugs as well as created new protection and detection capabilities for existing engine layers, so the exercise to adapt to testing was valuable. We signed up for AV-Comparatives (for both MB4 and Malwarebytes EP) and also AV-Test business tests. You will start seeing Malwarebytes for the first time ever in these tests soon.

 

[Digmor Crusher]

Thanks Pedro, looking forward to seeing more tests with MB participating.

 

[Andy Ful]

We signed up for AV-Comparatives (for both MB4 and Malwarebytes EP) and also AV-Test business tests. You will start seeing Malwarebytes for the first time ever in these tests soon.

I wish that the results will be as perfect as in the MRG Effitas test.
I noticed that in the Exploit/Fileless test all the samples were detected by signatures. Does MB4 use also a kind of Attack Surface Reduction rules to fight non-PE files?

 

[pbust]

We don't get to see the details of the testcases which were blocked, only the misses. So it was hard to distinguish what qualifies as signature vs behavior block.In the case of Malwarebytes, our anti-exploit's application behavior protection technology (we call it mbae layer3), is like a beefed up Attack Surface Reduction that protects against both PE and non-PE payloads. I am guessing that those exploits/fileless were blocked by MBAE's layer3, but they do show as signature for some odd reason.

 

[Andy Ful]

From the report, it follows that MRG Effitas count signature blocks in Exploit / Fileless test as follows:

"The test case is marked as “Signature Block” if the security application blocks the URL (infected URL, exploit kit URL, redirection URL, malware URL) by the URL database (local or cloud)."

So maybe MB could recognize by URLs the exploit kits used in the test (Koadic, Empire, Metasploit).

 

[pbust]

MBAE can also block URLs when blocking web-based exploits. It's still 100% behavior.
But you're right, these could be signature-based blocks. It's hard to tell which one it was without screenshots or logs.

 

[James246]

Let's wait for more information.

I see in the latest AV Tests Malwarebytes has scored Six for protection, so it looks as though a breakthrough may have been made .