Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 876972" data-attributes="member: 83059">Yup that&#039;s exactly what I expect out of signature scanning. Whether it&#039;s ML or not, you can only tell so much from static inspection, which is why most enterprise and cloud products that claim to protect against APTs will use some sort of virtualization/sandbox-based detonation.A behavior blocker can simply be thought as an extremely dangerous local version of that -- it&#039;s a local malware detonator that runs unprotected on your machine. If it identifies the suspicious behavior you&#039;re safe, if it doesn&#039;t, your host machine is compromised.But at least when the malware detonates, there is very little you can do to hide the behavior. Like in your exploit, at some point you have to spawn 7z.exe with a -p and a -sdel argument. You can infinitely hide the code that spawns that, but by the time it turns into a Win32 API call you cannot hide it anymore. That&#039;s why I put so much value in a behavior blocker.</blockquote>

[QUOTE="MacDefender, post: 876972, member: 83059"] Yup that's exactly what I expect out of signature scanning. Whether it's ML or not, you can only tell so much from static inspection, which is why most enterprise and cloud products that claim to protect against APTs will use some sort of virtualization/sandbox-based detonation. A behavior blocker can simply be thought as an extremely dangerous local version of that -- it's a local malware detonator that runs unprotected on your machine. If it identifies the suspicious behavior you're safe, if it doesn't, your host machine is compromised. But at least when the malware detonates, there is very little you can do to hide the behavior. Like in your exploit, at some point you have to spawn 7z.exe with a -p and a -sdel argument. You can infinitely hide the code that spawns that, but by the time it turns into a Win32 API call you cannot hide it anymore. That's why I put so much value in a behavior blocker. [/QUOTE]

Verification