I am also interested in knowing if there are any differences in the core technology of the Malwarebytes - persona;;y I suspect there isn't - perhaps this result is a one off anomaly.
MRG Effitas MRG Effitas 360 Degree Assessment & Certification Q4 2020
- Thread starter Andy Ful
- Start date
- May 26, 2014
- 1,168
The source is the blog, the official forum with years and years of changelogs of the beta + release versions and the Staff comments, so if one is actually involved with it can see clearly how their technology is implemented; they still keep beta versions of standalone modules like Anti Exploit and Anti Ransomware just to port the technology for Malwarebytes Premium and them for the Endpoint Protection.
Example:
Latest version of MBARW Beta v0.9.19.73 - 1.1.428 released 24 Aug 2021
Hello, The latest version of Malwarebytes Anti-Ransomware - Beta 10 (version 0.9.19) is now available for download. VERY IMPORTANT!!: Malwarebytes 3/4 and MBARW - It is actually not possible to run the free version of Malwarebytes 3/4 and the standalone Anti-Ransomware Beta side-by-side, as they ...
Malwarebytes Anti-Exploit 1.13 Build 407 released - Sep 1, 2021
We're happy to announce the release of Malwarebytes Anti-Exploit Beta 1.13 Build 407. This is a full Beta version with premium features available to Free users: Download this Release version here Malwarebytes Anti-Exploit 1.13.1.407 Protection: New protection technique to block exploits from abus...
All the protection features are ported from those standalone betas modules to Malwarebytes Premium (consumer) and them the stable release of Malwarebytes Premium becomes the Endpoint Protection.
https://www.malwarebytes.com/pdf/guides/MBAEBGuide.pdf (take a look of this old Malwarebytes Anti Exploit features)
There is no tweak or downgrade of those technologies while ported to Malwarebytes Premium, in the same sense there is no "upgrade" or more advanced features in the enterprise versions, save for the Response Module and the cloud management.
Your argument about those features being not fully implemented in the consumer version is just a speculation, I dont want to search for literally years of posts, so if you dont believe in my word and my experience with their products you can just ask in their forums.
Their technology:
Why Choose Malwarebytes | Malwarebytes
Announcing Malwarebytes 4.0: smarter, faster, and lighter - Malwarebytes Labs
Malwarebytes 4.0 not only sports a whole new look, but packs cutting-edge detection methods into a lightweight, lightning-fast program.
blog.malwarebytes.com
Announcing Malwarebytes 3.0, a next-generation antivirus replacement - Malwarebytes Labs
Announcing the launch of our next-generation online security product, Malwarebytes 3.0! This product is built to provide comprehensive protection against today’s sophisticated threats so that you can finally replace your traditional antivirus software.
blog.malwarebytes.com
TLDR: Malwarebytes Endpoint Protection is Malwarebytes Premium + Console
Last edited:
- Dec 30, 2012
- 4,745
Two surprises here,the low score for Symantec and the high score for MB
- Dec 23, 2014
- 6,152
I do not say that you must be wrong. Anyway, there is a reasonable doubt, because several vendors do it. But my primary hesitation is related to the disproportion in MB scorings between the MRG Effitas test and other tests. Something like a comparison of features between different MB versions would help, but I could not find any.
By the way, Nebula uses cloud sandbox to investigate unknown threats. Does MB use this feature?
Last edited:
- May 26, 2014
- 1,168
Not applicable in this test, this feature is for malware remediation, not prevention and this isnt the scope of the test and that wasnt the product that was tested.
Here the difference:
Malwarebytes Nebula
Malwarebytes Nebula Platform is a cloud-hosted security platform made for small to large businesses. Increase security without compromising productivity.
Malwarebytes Endpoint Detection and Response for Business (The endpoint protection plus "Response" module).
Reiner
Level 2
- Jan 26, 2021
- 70
Guys, don't take this test as an absolute truth, it's just a test like those of AV TEST, AV-Comparatives and etc, all questionable, and always.. always take it like a grain of salt, If there’s anything we can trust, it’s on the site’s hub
- Apr 1, 2019
- 2,204
Maybe we need to ask @harlan4096 kindly to test Malwarebytes Premium (I can help with a license if necessary) next.
- Dec 23, 2014
- 6,152
Yes. I found the comparison of these two versions:
So, it seems that we cannot explain for now the perfect scoring in the MRG Effitas test.
- Dec 23, 2014
- 6,152
You are talking to guys who are already very suspicious:
AV-Comparatives - Randomness in the AV Labs testing.
Let's consider the example of the initial pule of 30000 sufficiently different malware variants in the wild and the particular AV which failed to detect 100 of them. Next, we make for the above results a trial to choose 380 samples from these 30000 and calculate the probabilities for finding in...
malwaretips.com
Simply, such a perfect result in many different categories would not be especially probable for MB Premium even in a single test.
Last edited:
- May 26, 2014
- 1,168
@Andy Ful
Malwarebytes staff finally answered you.
forums.malwarebytes.com
Malwarebytes staff finally answered you.
MB version differences
Hi, Is there any difference between MB Premium and MB Endpoint Protection except the features related strictly to Nebula Platform? It seems that MB Endpoint Protection started to participate in MRG Effitas tests and scored perfectly in all categories: In the Wild 360, Ransomware, Financial, PUA/A...
- Dec 23, 2014
- 6,152
@AlexSmith (Technical Product Manager) answered:
"Outside of the Nebula platform specific features, Malwarebytes Endpoint Protection is the technical equivalent to Malwarebytes Premium."
I am not sure if these platform specific features can explain the disproportion of testing results. So, we should wait for more tests.
I have invited @AlexSmith to post here about MB protection.
https://forums.malwarebytes.com/topic/271328-mb-version-differences/?do=findComment&comment=1442775
"Outside of the Nebula platform specific features, Malwarebytes Endpoint Protection is the technical equivalent to Malwarebytes Premium."
I am not sure if these platform specific features can explain the disproportion of testing results. So, we should wait for more tests.
I have invited @AlexSmith to post here about MB protection.
https://forums.malwarebytes.com/topic/271328-mb-version-differences/?do=findComment&comment=1442775
Last edited:
So either Malwarebytes has made some kind of breakthrough or the result is a one off ( the latter is probably more likely though the former would be preferred )
- Dec 23, 2014
- 6,152
Let's wait for more information.
pbust
Level 1
- Sep 4, 2012
- 26
Hi, was pointed to this post. Pedro Bustamante here, head of research and innovation at malwarebytes... excuse the old Panda icon
I can confirm both the MB4core and corporate EP core detection is exactly the same. We do have a separate EDR business product that includes a few more cloud-based detection technologies, but that was not tested at MRG. The bad performance rating was a config error on our part as we provisioned EDR instead of EP (even though the EDR detections don't count for points in the MRG test). In the next test you'll see the real performance impact comparative.
In terms of participating and focusing on 3rd party tests, we made the decision about a year ago to focus on improving in these tests. The launch of Katana by incorporating a few more static (sig and heuristic) and dynamic (runtime sandbox) engine layers has helped bridge the historic gap. During the process we found and fixed bugs as well as created new protection and detection capabilities for existing engine layers, so the exercise to adapt to testing was valuable. We signed up for AV-Comparatives (for both MB4 and Malwarebytes EP) and also AV-Test business tests. You will start seeing Malwarebytes for the first time ever in these tests soon.
I can confirm both the MB4core and corporate EP core detection is exactly the same. We do have a separate EDR business product that includes a few more cloud-based detection technologies, but that was not tested at MRG. The bad performance rating was a config error on our part as we provisioned EDR instead of EP (even though the EDR detections don't count for points in the MRG test). In the next test you'll see the real performance impact comparative.
In terms of participating and focusing on 3rd party tests, we made the decision about a year ago to focus on improving in these tests. The launch of Katana by incorporating a few more static (sig and heuristic) and dynamic (runtime sandbox) engine layers has helped bridge the historic gap. During the process we found and fixed bugs as well as created new protection and detection capabilities for existing engine layers, so the exercise to adapt to testing was valuable. We signed up for AV-Comparatives (for both MB4 and Malwarebytes EP) and also AV-Test business tests. You will start seeing Malwarebytes for the first time ever in these tests soon.
- Jan 27, 2018
- 530
Thanks Pedro, looking forward to seeing more tests with MB participating.
- Dec 23, 2014
- 6,152
I wish that the results will be as perfect as in the MRG Effitas test.
I noticed that in the Exploit/Fileless test all the samples were detected by signatures. Does MB4 use also a kind of Attack Surface Reduction rules to fight non-PE files?
pbust
Level 1
- Sep 4, 2012
- 26
We don't get to see the details of the testcases which were blocked, only the misses. So it was hard to distinguish what qualifies as signature vs behavior block.In the case of Malwarebytes, our anti-exploit's application behavior protection technology (we call it mbae layer3), is like a beefed up Attack Surface Reduction that protects against both PE and non-PE payloads. I am guessing that those exploits/fileless were blocked by MBAE's layer3, but they do show as signature for some odd reason.
- Dec 23, 2014
- 6,152
From the report, it follows that MRG Effitas count signature blocks in Exploit / Fileless test as follows:
"The test case is marked as “Signature Block” if the security application blocks the URL (infected URL, exploit kit URL, redirection URL, malware URL) by the URL database (local or cloud)."
So maybe MB could recognize by URLs the exploit kits used in the test (Koadic, Empire, Metasploit).
"The test case is marked as “Signature Block” if the security application blocks the URL (infected URL, exploit kit URL, redirection URL, malware URL) by the URL database (local or cloud)."
So maybe MB could recognize by URLs the exploit kits used in the test (Koadic, Empire, Metasploit).
Last edited:
pbust
Level 1
- Sep 4, 2012
- 26
MBAE can also block URLs when blocking web-based exploits. It's still 100% behavior.
But you're right, these could be signature-based blocks. It's hard to tell which one it was without screenshots or logs.
But you're right, these could be signature-based blocks. It's hard to tell which one it was without screenshots or logs.
I see in the latest AV Tests Malwarebytes has scored Six for protection, so it looks as though a breakthrough may have been made .Let's wait for more information.
Similar threads
