Reply to thread

Message

<blockquote data-quote="Adrian Ścibor" data-source="post: 1037439" data-attributes="member: 71496">OK, Gentleman. Let&#039;s say the Webroot was one of the first <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />On second thought, this information will be addresses to technical geeks. We need to think whether this will be interesting at all:HKLM\SOFTWARE\WOW6432Node\WRData\Status\InfectedHKLM\SOFTWARE\WOW6432Node\WRData\Status\ThreatBlockedHKLM\SOFTWARE\WOW6432Node\WRData\Status\ThreatsRemovedHKLM\SOFTWARE\WOW6432Node\WRData\Status\WasJustInfectedHKLM\SOFTWARE\WOW6432Node\WRData\Threats\*HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active\CountHKLM\SOFTWARE\WOW6432Node\WRData\Status\CurrentlyCleaningHKLM\SOFTWARE\WOW6432Node\WRData\FileFlagsC:\ProgramData\WRData\WRLog.txtC:\ProgramData\WRData\WRLog.log !!! So important for unknown filesC:\ProgramData\WRData\ace1.db or \ace*C:\ProgramData\WRData\dbk.db or \dbk*So, these are so-called Webroot&#039;s Antivirus Indicators - when some of them is triggered and logged by Sysmon, we know that malware is or was processing successfully.*edited*If you want to test it or similar indicators for another AV at own machine, please do not forget to set a Sysmon driver altitude regarding with our methodology (recommended): <a href="https://avlab.pl/en/methods-of-carrying-out-automatic-tests/" target="_blank">Methods Of Carrying Out Automatic Tests » AVLab Cybersecurity Foundation</a>[CODE]To change the Sysmon driver altitude we suggest the following CLI command:reg add &quot;HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Instances\Sysmon Instance&quot; /v Altitude /t REG_SZ /d 244999[/CODE]OK, let&#039;s see how it goes after the May edition.I do not say - NO. maybe in next upcoming months. CheckPoint has changed Kaspersky&#039;s engine to another one, therefore it might be interesting to see their product on the list.</blockquote>

[QUOTE="Adrian Ścibor, post: 1037439, member: 71496"] OK, Gentleman. Let's say the Webroot was one of the first :) On second thought, this information will be addresses to technical geeks. We need to think whether this will be interesting at all: HKLM\SOFTWARE\WOW6432Node\WRData\Status\Infected HKLM\SOFTWARE\WOW6432Node\WRData\Status\ThreatBlocked HKLM\SOFTWARE\WOW6432Node\WRData\Status\ThreatsRemoved HKLM\SOFTWARE\WOW6432Node\WRData\Status\WasJustInfected HKLM\SOFTWARE\WOW6432Node\WRData\Threats\* HKLM\SOFTWARE\WOW6432Node\WRData\Threats\Active\Count HKLM\SOFTWARE\WOW6432Node\WRData\Status\CurrentlyCleaning HKLM\SOFTWARE\WOW6432Node\WRData\FileFlags C:\ProgramData\WRData\WRLog.txt C:\ProgramData\WRData\WRLog.log !!! So important for unknown files C:\ProgramData\WRData\ace1.db or \ace* C:\ProgramData\WRData\dbk.db or \dbk* So, these are so-called Webroot's Antivirus Indicators - when some of them is triggered and logged by Sysmon, we know that malware is or was processing successfully. *edited* If you want to test it or similar indicators for another AV at own machine, please do not forget to set a Sysmon driver altitude regarding with our methodology (recommended): [URL="https://avlab.pl/en/methods-of-carrying-out-automatic-tests/"]Methods Of Carrying Out Automatic Tests » AVLab Cybersecurity Foundation[/URL] [CODE]To change the Sysmon driver altitude we suggest the following CLI command: reg add "HKLM\SYSTEM\CurrentControlSet\Services\SysmonDrv\Instances\Sysmon Instance" /v Altitude /t REG_SZ /d 244999[/CODE] OK, let's see how it goes after the May edition. I do not say - NO. maybe in next upcoming months. CheckPoint has changed Kaspersky's engine to another one, therefore it might be interesting to see their product on the list. [/QUOTE]

Verification