Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 979543" data-attributes="member: 32260">Although the &quot;EXE test error&quot; makes the interpretation of test results much harder, the EXE tests can show one thing.One should prefer AVs that have got strong protection/prevention against all kinds of files (especially scripts and documents). But, using an additional security layer for EXE files (or better for PE files) can be still recommended in businesses.In businesses, many payloads can be delivered directly via lateral movement without using documents (and truly malicious scripts). So, we have more initial malware and fewer true payloads (probably 1/10 instead of 1/2) for the computers in the already infected network. The &quot;EXE test error&quot; is smaller:Rate of false infections = 1/10 * 0.3 * 1/3 * 1/2 = 3/600 ~ 0.5%The &quot;EXE test error&quot; is now caused by ignoring some scripting methods in the test.Edit1.At home, a similar situation can be caused when flash drives are extensively used for sharing files, cracks, pirated software. Most EXE payloads can be delivered in this way without using documents and scripts.</blockquote>

[QUOTE="Andy Ful, post: 979543, member: 32260"] Although the "EXE test error" makes the interpretation of test results much harder, the EXE tests can show one thing. One should prefer AVs that have got strong protection/prevention against all kinds of files (especially scripts and documents). But, using an additional security layer for EXE files (or better for PE files) can be still recommended in businesses. In businesses, many payloads can be delivered directly via lateral movement without using documents (and truly malicious scripts). So, we have more initial malware and fewer true payloads (probably [B][COLOR=rgb(184, 49, 47)]1/10 [/COLOR][/B]instead of 1/2) for the computers in the already infected network. The "EXE test error" is smaller: [B]Rate of false infections = [COLOR=rgb(184, 49, 47)]1/10[/COLOR] * 0.3 * 1/3 * 1/2 = 3/600 ~ 0.5% The "EXE test error" is now caused by ignoring some scripting methods in the test.[/B] Edit1. At home, a similar situation can be caused when flash drives are extensively used for sharing files, cracks, pirated software. Most EXE payloads can be delivered in this way without using documents and scripts. [/QUOTE]

Verification