Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 979407" data-attributes="member: 32260">The peculiarity of EXE malware testing.Let&#039;s look at the distribution of malware in the wild by file types:[ATTACH=full]265013[/ATTACH][URL unfurl=&quot;false&quot;]https://static.poder360.com.br/2021/07/relatorio.pdf[/URL]We know that archives contain mostly EXE files, documents, and scripts. So, we can conclude that roughly 1/3 of initial malware are EXE files, 1/3 documents (PDF, Office), and 1/3 scripts. The attacks started with documents or scripts can often include EXE files at the later infection stage. So, most EXE malware will not be initial malware but EXE payloads that appear later in the infection chain.Let&#039;s inspect the protection of two AVS (&quot;A&quot; and &quot;B&quot;) which have got identical capabilities for detecting unknown EXE files, but the &quot;A&quot; has got additional strong protection against documents and scripts. It is obvious that:Protection of &quot;A&quot; &gt; Protection of &quot;B&quot;The &quot;A&quot; can detect/block the document or script before the payload could be executed. So, there can be many 0-day EXE payloads in the wild attacks that will compromise &quot;B&quot; and will be prevented by &quot;A&quot;.After being compromised, the &quot;B&quot; creates fast signature or behavior detection, and for the &quot;A&quot; the payload is invisible.If we will make a test on AVs &quot;A&quot; and &quot;B&quot; the next day the results will be strange:The &quot;B&quot; will properly detect these payloads and the &quot;A&quot; will miss them. The result of the test:Protection of &quot;A&quot; &lt; Protection of &quot;B&quot;The above false result holds despite the fact that &quot;A&quot; and &quot;B&quot; have got identical capabilities for detecting EXE files and despite the fact, that in the wild the &quot;A&quot; protects better.The error follows from the fact that the AV cloud backend can quickly react when it is compromised, and much slower if it is not. There are many people involved in threat hunting, so after some time most of these invisible (for &quot;A&quot;) EXE payloads are added to detections (even if they did not compromise &quot;A&quot; in the wild).Anyway, this reasoning does not apply to AVs that use file reputation lookup for EXE files. Such AVs will block almost all EXE samples both in the wild and in the tests.How to minimize this error?<ol>
<li data-xf-list-type="ol">Using initial attack samples (like in the Real-World tests).</li>
<li data-xf-list-type="ol">Using many 0-day unknown samples. The more unknown samples the smaller will be the error.</li>
<li data-xf-list-type="ol">Using prevalent samples (like in the Malware Protection tests made by AV-Comparatives and AV-Test). The &quot;A&quot; has more chances to quickly add the detections of prevalent samples.</li>
</ol>For a less technical explanation, please look here:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/pecuriality-of-exe-malware-testing.112854/post-979714[/URL]</blockquote>

[QUOTE="Andy Ful, post: 979407, member: 32260"] [B][SIZE=5]The peculiarity of EXE malware testing.[/SIZE][/B] Let's look at the distribution of malware in the wild by file types: [ATTACH type="full" alt="1647451715025.png"]265013[/ATTACH] [URL unfurl="false"]https://static.poder360.com.br/2021/07/relatorio.pdf[/URL] We know that archives contain mostly EXE files, documents, and scripts. So, we can conclude that roughly 1/3 of initial malware are EXE files, 1/3 documents (PDF, Office), and 1/3 scripts. The attacks started with documents or scripts can often include EXE files at the later infection stage. [COLOR=rgb(0, 168, 133)][B]So, most EXE malware will not be initial malware but EXE payloads that appear later in the infection chain.[/B][/COLOR] Let's inspect the protection of two AVS ("A" and "B") which have got identical capabilities for detecting unknown EXE files, but the "A" has got additional strong protection against documents and scripts. It is obvious that: [B][COLOR=rgb(41, 105, 176)]Protection of "A" > Protection of "B"[/COLOR][/B] The "A" can detect/block the document or script before the payload could be executed. So, there can be many 0-day EXE payloads in the wild attacks that will compromise "B" and will be prevented by "A". After being compromised, the "B" creates fast signature or behavior detection, and for the "A" the payload is invisible. If we will make a test on AVs "A" and "B" the next day the results will be strange: The "B" will properly detect these payloads and the "A" will miss them. The result of the test: [COLOR=rgb(184, 49, 47)][B]Protection of "A" < Protection of "B"[/B][/COLOR] [B]The above false result holds despite the fact that "A" and "B" have got identical capabilities for detecting EXE files and despite the fact, that in the wild the "A" protects better.[/B] [COLOR=rgb(0, 168, 133)][B]The error follows from the fact that the AV cloud backend can quickly react when it is compromised, and much slower if it is not. [/B][/COLOR] There are many people involved in threat hunting, so after some time most of these invisible (for "A") EXE payloads are added to detections (even if they did not compromise "A" in the wild). [I][B]Anyway, this reasoning does not apply to AVs that use file reputation lookup for EXE files. Such AVs will block almost all EXE samples both in the wild and in the tests.[/B][/I] How to minimize this error? [LIST=1] [*]Using initial attack samples (like in the Real-World tests). [*]Using many 0-day unknown samples. The more unknown samples the smaller will be the error. [*]Using prevalent samples (like in the Malware Protection tests made by AV-Comparatives and AV-Test). The "A" has more chances to quickly add the detections of prevalent samples. [/LIST] For a less technical explanation, please look here: [URL unfurl="false"]https://malwaretips.com/threads/pecuriality-of-exe-malware-testing.112854/post-979714[/URL] [/QUOTE]

Verification