Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 1097392" data-attributes="member: 7463">What confuses me is that you have stated previously that executing a file from the Desktop is somehow not &quot;real world&quot;, and should be differentiated from a file run from elsewhere (C:\Downloads, C:\Users\appdata\roaming, etc). In the same vein, how would a video authors decision to first do a custom scan then run undetected files from a malware pack in a C:\Malware directory be inferior?Also, regarding the scanning abilities of various AM products- some will just be aware of the file ID, and if matched will detect; some will indeed look deeper (eg: if a link is received in Gmail and thereby stored somewhere in the browser directory in AppData, a good AM app can detect a malicious Powershell or Python string). But as such scans can be implemented from anywhere the malware resides, including malware packs, how is such testing &quot;not real world&quot; and somehow inferior?Finally, the comment &quot;Many products control false positives by using more aggressive screening of downloads, as opposed to local files.&quot; should be questioned. This is implying that an AM application utilizes some sort of Folder Priority, when the emphasis should actually be placed the potential system changes made by the execution the malicious file, either as a direct result of it or by the concurrent spawning of a LoLbin.</blockquote>

[QUOTE="cruelsister, post: 1097392, member: 7463"] What confuses me is that you have stated previously that executing a file from the Desktop is somehow not "real world", and should be differentiated from a file run from elsewhere (C:\Downloads, C:\Users\appdata\roaming, etc). In the same vein, how would a video authors decision to first do a custom scan then run undetected files from a malware pack in a C:\Malware directory be inferior? Also, regarding the scanning abilities of various AM products- some will just be aware of the file ID, and if matched will detect; some will indeed look deeper (eg: if a link is received in Gmail and thereby stored somewhere in the browser directory in AppData, a good AM app can detect a malicious Powershell or Python string). But as such scans can be implemented from anywhere the malware resides, including malware packs, how is such testing "not real world" and somehow inferior? Finally, the comment "Many products control false positives by using more aggressive screening of downloads, as opposed to local files." should be questioned. This is implying that an AM application utilizes some sort of Folder Priority, when the emphasis should actually be placed the potential system changes made by the execution the malicious file, either as a direct result of it or by the concurrent spawning of a LoLbin. [/QUOTE]

Verification