Reply to thread

Message

<blockquote data-quote="Lenny_Fox" data-source="post: 919246" data-attributes="member: 82776">Dan,When I understand correctly, VoodooShield allows programs of same signer of already installed programs. For each individual VS user this is a tiny signature based whitelist which should have a small statistical chance of having signed malware.&nbsp; Espeacially when people combine VS with Microsoft Defender set on high with Configure Defender (the ASR rule &quot;Block executable files from running unless they meet a prevalence, age, or trusted list criterion&quot;) the chance of already being infected with signed malware is near zero.Paid user have the advantage of the larger based cloud whitelist of VS. I assume you have some sort of evaluation process before adding executables to teh cloud whitelist.With this in mind you could replace the signed software option in your evaluation to a limited VS determined list and let your AI do the rest. With the tiny local signatire based white list and the &#039;moderated&#039; cloud whitelist and a small VS trusted vendors list, I would say your AI engine could treat signed as just a data point in stead of the special (overweighed?) importance it gets in your AI-model right now.When you would treat the &quot;all other signatures&quot; (meaning not on my tiny local list, not on your limited trusted vendors list and not on the cured/moderated large cloud whitelist) as just a data point, what could go wrong in terms of false positives? Treating &quot;all other signatures&quot;as just a data point, would probably result in bad VS-AI scores of signed malware (what I understood of signed malware, because it is signed, it uses few other obfuscation to hide it is malware)RegardsLen</blockquote>

[QUOTE="Lenny_Fox, post: 919246, member: 82776"] Dan, When I understand correctly, VoodooShield allows programs of same signer of already installed programs. For each individual VS user this is a tiny signature based whitelist which should have a small statistical chance of having signed malware. Espeacially when people combine VS with Microsoft Defender set on high with Configure Defender (the ASR rule "Block executable files from running unless they meet a prevalence, age, or trusted list criterion") the chance of already being infected with signed malware is near zero. Paid user have the advantage of the larger based cloud whitelist of VS. I assume you have some sort of evaluation process before adding executables to teh cloud whitelist. With this in mind you could replace the signed software option in your evaluation to a limited VS determined list and let your AI do the rest. With the tiny local signatire based white list and the 'moderated' cloud whitelist and a small VS trusted vendors list, I would say your AI engine could treat signed as just a data point in stead of the special (overweighed?) importance it gets in your AI-model right now. When you would treat the "all other signatures" (meaning not on my tiny local list, not on your limited trusted vendors list and not on the cured/moderated large cloud whitelist) as just a data point, what could go wrong in terms of false positives? Treating "all other signatures"as just a data point, would probably result in bad VS-AI scores of signed malware (what I understood of signed malware, because it is signed, it uses few other obfuscation to hide it is malware) Regards Len [/QUOTE]

Verification