Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1000234" data-attributes="member: 32260">This test uses well known techniques. But in the real life, the attackers use some new techniques each year. The protection against new techniques is rather poor for most AVs (like in the Magniber example).In targeted attacks, many reputation-based protections can fail when the malware is signed by the EV certificate.The sandboxing-based protection can be also bypassed in several ways. For example, Avast CyberCapture can be bypassed by using the legal executable which is vulnerable to DLL hijacking. Other AVs can be fooled by using some LOLBins to run DLLs or load DLLs in an unusual way, etc.The monitoring in the sandbox can be fooled by using execution delays, anti-sandbox checks, or multistage attacks with unique encryption keys (not available in the sandbox).The increase in ransomware attacks proves that anti-ransomware protection is generally insufficient to protect government (central and local), organizations, institutions, businesses, healthcare, financial services, ... .<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />The situation can be better when the protection layers are managed by a qualified IT team. But in reality, most of the attacked targets try to save money and do not have such a team.</blockquote>

[QUOTE="Andy Ful, post: 1000234, member: 32260"] This test uses well known techniques. But in the real life, the attackers use some new techniques each year. The protection against new techniques is rather poor for most AVs (like in the Magniber example). In targeted attacks, many reputation-based protections can fail when the malware is signed by the EV certificate. The sandboxing-based protection can be also bypassed in several ways. For example, Avast CyberCapture can be bypassed by using the legal executable which is vulnerable to DLL hijacking. Other AVs can be fooled by using some LOLBins to run DLLs or load DLLs in an unusual way, etc. The monitoring in the sandbox can be fooled by using execution delays, anti-sandbox checks, or multistage attacks with unique encryption keys (not available in the sandbox). The increase in ransomware attacks proves that anti-ransomware protection is generally insufficient to protect government (central and local), organizations, institutions, businesses, healthcare, financial services, ... .:( The situation can be better when the protection layers are managed by a qualified IT team. But in reality, most of the attacked targets try to save money and do not have such a team. [/QUOTE]

Verification