It depends on how the vendor implemented it so there will be bound to be differences between different AV vendors.In other words, how does a AV behave when a malware with valid signature is executed? Does it blindly trust the certificate or does it e.g still monitor it/check the TVL?
If this check box is selected, Application Control classifies digitally signed applications as trusted. Application Control moves these applications to the Trusted group and does not scan their activity.
If this check box is cleared, Application Control does not classify digitally signed applications as trusted, and scans their activities.
Andy where did you find a sample of this Ransomware? I could try it against Cylance but not sure where to get this sample.Webroot and Microsoft now detect this ransomware on VT. Kaspersky, Trend Micro, and Cylance still do not. So it may be that for Kaspersky and Cylance, the ransomware detection on VT can be really different from their desktop software, as compared to test results posted on this thread.
Try the malware hub in the malware sample section. I assume you know how to deal with malware and anyone that do so is responsible for what happens, right?Andy where did you find a sample of this Ransomware? I could try it against Cylance but not sure where to get this sample.
It was checked by @Slyguy :Andy where did you find a sample of this Ransomware? I could try it against Cylance but not sure where to get this sample.
Yeah , it's actually the IT job to harden the system via SRP/application control.A superb question and a point I've been trying to make for a few years. You have 2 types of security Software- those that have an Enterprise presence (like Symantec, Mcafee) and those that do not. For those that have an Enterprise presence they are reticent to detect unknown Scriptors as malware; mainly this is due to many IP folks that utilize Scripts (macros, vb, python) to automate things like internal updating over the network. This has a downside as many of the major breaches you have heard of (like Target, Home Depot) and many that have been suppressed and you will NEVER hear of were caused by relatively trivial scripts getting by multi-million dollar security solutions (my favorite was when someone from Symantec called the malware that bypassed their product "something that could be coded by a 14 year old").
As to those products that do not have any significant Enterprise presence and still ignore scriptors (as an example seen a video I published on April 13th), I have no idea. I was always hoping that folks would get outraged, but apparently not...
In short, many products cannot distinguish a good Script from a Bad one. This is a pity.