Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 929608" data-attributes="member: 62850">If a bad actor has full access to the system or network then it is game over... of course the ransomware detection mechanism will fail if the bad actor shuts them down.For purposes of this discussion, it pretty much does not matter where in the attack chain the ransomware fires.&nbsp; It could be at the beginning, in the middle or at the end... what I am asking about is the actual ransomware detection mechanism itself.For example, one technique to evade detection would be randomize the order that the files are encrypted so that it is less likely to trigger detection on the bait files before a sufficient amount of files are encrypted.&nbsp; I am just curious what other “clever tricks” ransomware utilizes to evade detection while it is executing.I am extremely familiar with VT <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.</blockquote>

[QUOTE="danb, post: 929608, member: 62850"] If a bad actor has full access to the system or network then it is game over... of course the ransomware detection mechanism will fail if the bad actor shuts them down. For purposes of this discussion, it pretty much does not matter where in the attack chain the ransomware fires. It could be at the beginning, in the middle or at the end... what I am asking about is the actual ransomware detection mechanism itself. For example, one technique to evade detection would be randomize the order that the files are encrypted so that it is less likely to trigger detection on the bait files before a sufficient amount of files are encrypted. I am just curious what other “clever tricks” ransomware utilizes to evade detection while it is executing. I am extremely familiar with VT ;). [/QUOTE]

Verification