Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1084148" data-attributes="member: 99014">Every vendor has different vision how their product should work and protect users, although to a large extent modules, features and functions overlap.Some focus on reputation, others on machine learning, Eset is heavily focused on accurate, most of the time generic detections, that are machine-generated (documentation available as well) and on their local emulator for scripts, and executables.It is possible to activate more aggressive modes for the local emulator and a cloud emulator, including what they call “sandbox on steroids” (experimental) is available as well for downloads.It is possible to do a lot more to block fileless attacks, for example, I am fairly certain that no admin will start executing complicated scripts nowadays. And even if they do, I am certain they won’t be obfuscated and won’t include commands such as “join”, “split” and many others. I am also confident no admin will attempt to download files via certutil.However, Eset’s Research and Development team most likely hasn’t found the necessary evidence that their current approach doesn’t work and have hence, not implemented more generic blocks.Detection (signature) -&gt; generic detection -&gt; heuristic (short and effective logic) -&gt; behavioural profile -&gt; TTP-based behavioural analysis -&gt; policy-based behavioural blocking (lockdown mode)…The above progresses to more and more generic methods that can block more attacks and can also, create more false positives.Home products are more or less “one size for all” solutions.On business environments there are MSSPs that will analyse the solution weak points as well as the environment and will implement additional security measures.</blockquote>

[QUOTE="Trident, post: 1084148, member: 99014"] Every vendor has different vision how their product should work and protect users, although to a large extent modules, features and functions overlap. Some focus on reputation, others on machine learning, Eset is heavily focused on accurate, most of the time generic detections, that are machine-generated (documentation available as well) and on their local emulator for scripts, and executables. It is possible to activate more aggressive modes for the local emulator and a cloud emulator, including what they call “sandbox on steroids” (experimental) is available as well for downloads. It is possible to do a lot more to block fileless attacks, for example, I am fairly certain that no admin will start executing complicated scripts nowadays. And even if they do, I am certain they won’t be obfuscated and won’t include commands such as “join”, “split” and many others. I am also confident no admin will attempt to download files via certutil. However, Eset’s Research and Development team most likely hasn’t found the necessary evidence that their current approach doesn’t work and have hence, not implemented more generic blocks. Detection (signature) -> generic detection -> heuristic (short and effective logic) -> behavioural profile -> TTP-based behavioural analysis -> policy-based behavioural blocking (lockdown mode)… The above progresses to more and more generic methods that can block more attacks and can also, create more false positives. Home products are more or less “one size for all” solutions. On business environments there are MSSPs that will analyse the solution weak points as well as the environment and will implement additional security measures. [/QUOTE]

Verification