Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1084096" data-attributes="member: 99014">Once again, we are reaching the point where it should be mentioned that complete copy and paste of methods from vendor to vendor is not necessary.For the highest efficiency against fileless malware, it is of extreme importance that generic methods are developed — e.g evaluating LOLBins command lines and terminating execution there and then, as well as working closely with the AMSI and proprietary hooking.Just relying on web blocking and definitions is not enough as website/domain name may be new (or generated for the attack at the spot) as well as definitions on obfuscated code have 0 effectiveness.Having cloud emulation (sandbox) is another great approach.Then the question comes how important is blocking fileless attacks on home users machines.We do not have enough information to conclude how prevalent these are.</blockquote>

[QUOTE="Trident, post: 1084096, member: 99014"] Once again, we are reaching the point where it should be mentioned that complete copy and paste of methods from vendor to vendor is not necessary. For the highest efficiency against fileless malware, it is of [B]extreme[/B] importance that generic methods are developed — e.g [B]evaluating LOLBins command lines[/B] and terminating execution there and then, as well as working closely with the AMSI and proprietary hooking. Just relying on web blocking and definitions is not enough as website/domain name may be new (or generated for the attack at the spot) as well as definitions on obfuscated code have 0 effectiveness. Having cloud emulation (sandbox) is another great approach. Then the question comes how important is blocking fileless attacks on home users machines. We do not have enough information to conclude how prevalent these are. [/QUOTE]

Verification