Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1005041" data-attributes="member: 32260">Although I agree with [USER=95367]@Furyo[/USER] about SAC, the test would not be a bad idea. But, testing SAC with random malware cannot bring anything interesting. Even Defender on default settings can give a very good result.When testing EXE or MSI samples, all unknown &amp; unsigned samples are blocked by SAC. So the test should include signed malware (EXE, MSI) and scripting malware.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />It would be interesting to compare such results with @askalan&#039;s tests on SmartScreen for Explorer (Malware Hub samples). In his tests (no AV only SmartScreen), after a few months of testing (EXE and MSI malware with MOTW), only one sample bypassed SmartScreen and infected the system (another one did not infect the system).</blockquote>

[QUOTE="Andy Ful, post: 1005041, member: 32260"] Although I agree with [USER=95367]@Furyo[/USER] about SAC, the test would not be a bad idea. But, testing SAC with random malware cannot bring anything interesting. Even Defender on default settings can give a very good result. When testing EXE or MSI samples, all unknown & unsigned samples are blocked by SAC. So the test should include signed malware (EXE, MSI) and scripting malware.(y) It would be interesting to compare such results with @askalan's tests on SmartScreen for Explorer (Malware Hub samples). In his tests (no AV only SmartScreen), after a few months of testing (EXE and MSI malware with MOTW), only one sample bypassed SmartScreen and infected the system (another one did not infect the system). [/QUOTE]

Verification