Reply to thread

Message

<blockquote data-quote="Adrian Ścibor" data-source="post: 1063254" data-attributes="member: 71496">As you wrote - when it comes to 0-day, there may not be a perfect solution. However, 0-day is not a targeted APT attack. You can write a zero-day in a few lines in ChatGTP and there is no finesse here. This is why multi-layered protection is important. Look out for solutions that isolate unknown samples if you have doubts about 100% protection.If you look at the malware comparison CSV file, maybe less than 10% of the samples used in the test are 0-day for the MKS_VIR engine, which we use for initial sample analysis. This is the signature: INFECTION: HEUR.RoundKick.W.edit: So it&#039;s not like we&#039;re only using known threats. We use in-the-wild threats, and they are what they are. A 0-day for vendor X is not necessarily a 0-day for Y.With 0-day file (not url) will always be detected at post_lanuch level, there is no other way. I am not writing here about specific protection, such as the threat emulation while downloading in the browser (Zone Alarm / Check Point?)</blockquote>

[QUOTE="Adrian Ścibor, post: 1063254, member: 71496"] As you wrote - when it comes to 0-day, there may not be a perfect solution. However, 0-day is not a targeted APT attack. You can write a zero-day in a few lines in ChatGTP and there is no finesse here. This is why multi-layered protection is important. Look out for solutions that isolate unknown samples if you have doubts about 100% protection. If you look at the malware comparison CSV file, maybe less than 10% of the samples used in the test are 0-day for the MKS_VIR engine, which we use for initial sample analysis. This is the signature: INFECTION: HEUR.RoundKick.W. edit: So it's not like we're only using known threats. We use in-the-wild threats, and they are what they are. A 0-day for vendor X is not necessarily a 0-day for Y. With 0-day file (not url) will always be detected at [B]post_lanuch[/B] level, there is no other way. I am not writing here about specific protection, such as the threat emulation while downloading in the browser (Zone Alarm / Check Point?) [/QUOTE]

Verification