Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 979510" data-attributes="member: 83059">I definitely agree, a lot of the drive-by samples that I get by clicking through malvertising on my spam honeypot aren&#039;t PE executables. My best guess is that with all the SmartScreen and other warnings, it might tip off a user to the fact that this is unusual.For Powershell/VBS initial vectors, I&#039;ve seen a lot of them attempt to disable AV services by various ways. Most commonly, they look in Program Files for presence of specific AV software and then either run or download another script that cleverly tries to turn off each AV. It seems like they&#039;ve thought through how to defeat some anti-tamper systems -- for some AVs it&#039;s as simple as stopping a service. For others, they&#039;ll edit a configuration file or change a registry key.That might be a big part in answering how easily detectable EXE payloads seem to make it through AVs.</blockquote>

[QUOTE="MacDefender, post: 979510, member: 83059"] I definitely agree, a lot of the drive-by samples that I get by clicking through malvertising on my spam honeypot aren't PE executables. My best guess is that with all the SmartScreen and other warnings, it might tip off a user to the fact that this is unusual. For Powershell/VBS initial vectors, I've seen a lot of them attempt to disable AV services by various ways. Most commonly, they look in Program Files for presence of specific AV software and then either run or download another script that cleverly tries to turn off each AV. It seems like they've thought through how to defeat some anti-tamper systems -- for some AVs it's as simple as stopping a service. For others, they'll edit a configuration file or change a registry key. That might be a big part in answering how easily detectable EXE payloads seem to make it through AVs. [/QUOTE]

Verification