Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1036218" data-attributes="member: 99014">They communicate via the STAR bus, which is described here: <a href="https://www.broadcom.com/info/symantec/star" target="_blank">Star Malware Protection Technologies</a>Hiding via time-based tactics, such as doing something on a specific date or only after a reboot is a valid concern. The emulator which works between the static analysis scan and SONAR should detect instructions related to that and should “trick” the malware into believing these events have occurred by supplying fake time, date, system uptime and others.Behavioural blocking has no time threshold, data is written continuously about every process on disk as it works. From my observations, SONAR doesn’t have issues with executables, it is more iffy with Non-Process Threats that hide behind valid and signed Windows executables. SONAR would either just terminate the attack without even deleting the original file, or it won’t really detect anything. Trend Micro AEGIS and F-Secure DeepGuard work the same way so not sure what’s going on, there is some limitation there that engineers know of.</blockquote>

[QUOTE="Trident, post: 1036218, member: 99014"] They communicate via the STAR bus, which is described here: [URL="https://www.broadcom.com/info/symantec/star"]Star Malware Protection Technologies[/URL] Hiding via time-based tactics, such as doing something on a specific date or only after a reboot is a valid concern. The emulator which works between the static analysis scan and SONAR should detect instructions related to that and should “trick” the malware into believing these events have occurred by supplying fake time, date, system uptime and others. Behavioural blocking has no time threshold, data is written continuously about every process on disk as it works. From my observations, SONAR doesn’t have issues with executables, it is more iffy with Non-Process Threats that hide behind valid and signed Windows executables. SONAR would either just terminate the attack without even deleting the original file, or it won’t really detect anything. Trend Micro AEGIS and F-Secure DeepGuard work the same way so not sure what’s going on, there is some limitation there that engineers know of. [/QUOTE]

Verification