Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 968956" data-attributes="member: 32260">I was thinking about how this test can be improved. My final thought is that it should be repeated several times. This can help to eliminate some random factors like this one mentioned by me in the previous post.The test can be divided into two parts because the phishing part is independent of the rest.It could also help if [USER=92939]@Shadowra[/USER] could show more Indicators of Compromise (IoCs) because it is often hard to see if the leftovers are real IoCs or not.The method of calculating the scorings on the basis of on-demand scanners seems to show which AV is cleaner (leaves a smaller number of leftovers) and this can be related to the architecture of detections. Some AVs rely on the fast signatures in the cloud and these AVs will detect most malware without executing them (small number of leftovers). Others can rely more on post-execution detection (more leftovers).</blockquote>

[QUOTE="Andy Ful, post: 968956, member: 32260"] I was thinking about how this test can be improved. My final thought is that it should be repeated several times. This can help to eliminate some random factors like this one mentioned by me in the previous post. The test can be divided into two parts because the phishing part is independent of the rest. It could also help if [USER=92939]@Shadowra[/USER] could show more Indicators of Compromise (IoCs) because it is often hard to see if the leftovers are real IoCs or not. The method of calculating the scorings on the basis of on-demand scanners seems to show which AV is cleaner (leaves a smaller number of leftovers) and this can be related to the architecture of detections. Some AVs rely on the fast signatures in the cloud and these AVs will detect most malware without executing them (small number of leftovers). Others can rely more on post-execution detection (more leftovers). [/QUOTE]

Verification