Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1113762" data-attributes="member: 99014">Hello,I am not very active on here nowadays but let me reply to these questions.It is already kinda aggressive through behavioural guard and it gets more and more aggressive every day. There is still more to be desired (there always is).Local scripts that you create yourself are generally not emulated.Local scripts that are dropped by applications with unfavourable reputation are emulated, which leads to the next point.At Check Point, all system objects have reputation. Object can be file, folder, registry key (service which as well is in the registry), shortcut, memory object (such as named pipe) and URL/IP address.Possible reputations are safe, malicious, suspicious, unknown.So, files such as downloads will always be emulated, as long as the format is supported. The file level emulation decides based on the reputation of the object — objects proven as safe are not emulated, objects proven malicious are removed/blocked. It is only suspicious and unknown objects that need more digging around.Now to the fake stores, Zero Phishing is not yet equipped with any models that can detect fake stores. It does block everything that involves brand impersonation, but when the brand itself is scam… can’t do anything.In this relation, adding additional extensions might help, but unfortunately none of them offer perfect protection against scam websites and stores. They can sometimes be difficult even for the most senior content analyst, let alone an extension or an AI model.</blockquote>

[QUOTE="Trident, post: 1113762, member: 99014"] Hello, I am not very active on here nowadays but let me reply to these questions. It is already kinda aggressive through behavioural guard and it gets more and more aggressive every day. There is still more to be desired (there always is). Local scripts that you create yourself are generally not emulated. Local scripts that are dropped by applications with unfavourable reputation are emulated, which leads to the next point. At Check Point, all system objects have reputation. Object can be file, folder, registry key (service which as well is in the registry), shortcut, memory object (such as named pipe) and URL/IP address. Possible reputations are safe, malicious, suspicious, unknown. So, files such as downloads will always be emulated, as long as the format is supported. The file level emulation decides based on the reputation of the object — objects proven as safe are not emulated, objects proven malicious are removed/blocked. It is only suspicious and unknown objects that need more digging around. Now to the fake stores, Zero Phishing is not yet equipped with any models that can detect fake stores. It does block everything that involves brand impersonation, but when the brand itself is scam… can’t do anything. In this relation, adding additional extensions might help, but unfortunately none of them offer perfect protection against scam websites and stores. They can sometimes be difficult even for the most senior content analyst, let alone an extension or an AI model. [/QUOTE]

Verification