Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 979544" data-attributes="member: 32260">The importance of MOTW in testing.MOTW is Mark Of The Web. [URL unfurl=&quot;true&quot;]https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/[/URL]It is important in Real-World testing. MOTW is attached to files downloaded from the Internet by using web browsers, OneDrive, etc. Many AVs use it for better detection of PE files (EXE, DLL), documents, MSI installers, and scripts. These additional protection layers are usually triggered even with empty MOTW.Of course, the payloads are downloaded by initial malware without MOTW. So, when testing how AVs can protect against lateral movement in businesses and organizations, one should probably use samples without MOTW.</blockquote>

[QUOTE="Andy Ful, post: 979544, member: 32260"] [B][SIZE=5]The importance of MOTW in testing.[/SIZE][/B] [SIZE=4]MOTW is Mark Of The Web. [/SIZE] [URL unfurl="true"]https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/[/URL] [SIZE=4]It is important in Real-World testing. MOTW is attached to files downloaded from the Internet by using web browsers, OneDrive, etc. Many AVs use it for better detection of PE files (EXE, DLL), documents, MSI installers, and scripts. These additional protection layers are usually triggered even with empty MOTW. [B]Of course, the payloads are downloaded by initial malware without MOTW. So, when testing how AVs can protect against lateral movement in businesses and organizations, one should probably use samples without MOTW.[/B][/SIZE] [/QUOTE]

Verification