Software Review Windows Defender vs Ransomware

[XxX Legolas XxX]

Content source

https://youtu.be/LecgYgfEVVE

And what happened why the system was infected why it was not stopped Ransomware?

 

[XxX Legolas XxX]

That's your job to figure out and explain.

This is not my video i found it on youtube but if it my job Ransomware infect Windows 10 boot maybe if he add system folder in Protected folderds Windows 10 would be clean.

 

[struppigel]

Ransomware-specific protection will, among others, check the following behaviour:

• writing to AV specific bait files
• modification of many files in a row
• entropy increase in modified files
• file extension change
• shadow copy deletion

If one ransomware already encrypted files and bait files, other ransomware that would target the same files has nothing to do anymore (given that it searches by extensions which have already been changed).
It will not encrypt, not change entropy, not modify the bait files and therefore not show any malicious behaviour that might have been detected.

More general protection mechanisms also include the way samples were obtained, e.g., files that were downloaded via a browser have a specific identifier. These identifiers are missing here. Files that arrive via email attachments, downloaders, droppers or exploits, show certain malware typical patterns that are detected as well. None of these protection mechanisms have a chance in this artificial testing scenario.

Unless you actually want to protect your system from a scenario where you will execute hundrets of ransomware samples in a row, this test is not meaningful in any way.

 

[Andy Ful]

The video as an anti-ransomware protection test has many flaws noted already in this thread. Anyway, it is a good basic presentation of the AV capabilities for educational purposes. it can also show that the protection of Defender free on default settings with additionally enabled Controlled Folder Access can be compromised by some sophisticated ransomware.
It seems that at least one sample (MedusaLocker) partially defeated Defender. Although the files in protected folders were not encrypted, some other files were successfully encrypted and the ransomware made the system unbootable for some reason (not uncovered in the video). For more comprehensive protection the Defender settings require enabling ASR rules. The MedusaLocker samples were used in the targeted attacks especially in the healthcare industry.

Secure What's Next | LevelBlue

www.cybereason.com

TAU Threat Analysis: Medusa Locker Ransomware | VMware Carbon Black

In recent weeks Carbon Black’s Threat Analysis Unit (TAU) has seen an increase in the number of infections attributed to the Medusa Locker ransomware family. There were notable traits exhibited by Medusa Locker in these attacks that warranted further investigation to determine behavioral tactics...

www.carbonblack.com

 

[koloveli]

windows defender improve...