Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 906994" data-attributes="member: 32260">Hi [USER=89087]PhantomHacker[/USER],It has been an interesting research. I could sum up your post even more. This method of attack can mimic the user actions very well, so most (probably all) AVs that depend on behavior-based detections will fail (for now). It will be probably adopted in-the-wild soon.Anyway, it contains the &quot;chain of user actions&quot; that is suspicious. In theory such malware can be detected by machine learning. For example, the time of doing some mimicked user actions will be much shorter as compared to real user actions. The machine learning algorithms can possibly find more suspicious patterns, like opening another desktop --&gt; opening WE --&gt; running CMD sessions --&gt; etc.Of course, the attacker can refine the attack to avoid detection again and the defenders will improve the ML algorithms, etc.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 906994, member: 32260"] Hi [USER=89087]PhantomHacker[/USER], It has been an interesting research. I could sum up your post even more. This method of attack can mimic the user actions very well, so most (probably all) AVs that depend on behavior-based detections will fail (for now). It will be probably adopted in-the-wild soon. Anyway, it contains the "chain of user actions" that is suspicious. In theory such malware can be detected by machine learning. For example, the time of doing some mimicked user actions will be much shorter as compared to real user actions. The machine learning algorithms can possibly find more suspicious patterns, like opening another desktop --> opening WE --> running CMD sessions --> etc. Of course, the attacker can refine the attack to avoid detection again and the defenders will improve the ML algorithms, etc.:)(y) [/QUOTE]

Verification