Reply to thread

Message

<blockquote data-quote="notabot" data-source="post: 841371" data-attributes="member: 75970">Thanks ! I think it makes sense, to use a scale to rank signatures based on how well the signed binaries have been behaving so far - but just one caveat, signed malware has so far come out of small companies which haven&#039;t released malware before, probably the malware authors stole their private keys and has never been signed by a non-revoked key from a big tech co, is this reflected in your certificate trust system ? &nbsp;( I guess as the binaries by big tech cos are plenty &amp; well behaving vs a smaller vendor whose binaries are fewer &amp; well behaving, if you somehow account for sample size, you would heuristically catch this )&nbsp;Do you know if Emsisoft works well with GPO hardening, eg Australian Cybersecurity Guides on GPO hardening (excluding the policies on having Windows Defender always on of course)?&nbsp;Also, how well does Emsisoft work together with an anti-exe like Voodooshield or SecureAPlus? - the reason I ask is this is another complementary way, without using injections, to monitor parent-child processes for eg the browser ( though it leaves out the malware doing all the work in-process by loading dlls or querying COM interfaces ).&nbsp;( Windows natively also offers WDAC so emsisoft could offer configs for that <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /> in the future ? )&nbsp;I like a lot of Emsisoft&#039;s features, you do not intercept certificates when scanning https traffic, you seem quite privacy aware, I may bite the bullet <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /> - for me the most important features are A. the web dashboard as this way I can monitor all family machines from one place and B. the strength of your BB as I won&#039;t whitelist or blacklist runtimes &amp; interpreters.</blockquote>

[QUOTE="notabot, post: 841371, member: 75970"] Thanks ! I think it makes sense, to use a scale to rank signatures based on how well the signed binaries have been behaving so far - but just one caveat, signed malware has so far come out of small companies which haven't released malware before, probably the malware authors stole their private keys and has never been signed by a non-revoked key from a big tech co, is this reflected in your certificate trust system ? ( I guess as the binaries by big tech cos are plenty & well behaving vs a smaller vendor whose binaries are fewer & well behaving, if you somehow account for sample size, you would heuristically catch this ) Do you know if Emsisoft works well with GPO hardening, eg Australian Cybersecurity Guides on GPO hardening (excluding the policies on having Windows Defender always on of course)? Also, how well does Emsisoft work together with an anti-exe like Voodooshield or SecureAPlus? - the reason I ask is this is another complementary way, without using injections, to monitor parent-child processes for eg the browser ( though it leaves out the malware doing all the work in-process by loading dlls or querying COM interfaces ). ( Windows natively also offers WDAC so emsisoft could offer configs for that :unsure: in the future ? ) I like a lot of Emsisoft's features, you do not intercept certificates when scanning https traffic, you seem quite privacy aware, I may bite the bullet :) - for me the most important features are A. the web dashboard as this way I can monitor all family machines from one place and B. the strength of your BB as I won't whitelist or blacklist runtimes & interpreters. [/QUOTE]

Verification