Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1117260" data-attributes="member: 32260">If we forget about invalid testing methodology, this video can be an interesting demonstration of (possibly) new ransomware. The sample missed in the test was submitted to Virus Total one day before the test and was poorly detected by other AVs. Interestingly, in the test, it managed to encrypt only some files. We cannot exclude the possibility that the ransomware was detected post-execution (that is how &quot;Block at first sight&quot; works in Microsoft Defender for some unknown samples).Generally, I like this video demonstration (not a real test). The author tried to be neutral in his comments.Microsoft Defender missed 1 per 98 samples (the &quot;test&quot; was unfinished) which could often happen for any popular AV. So, I cannot say that this demonstration bashes Microsoft Defender.The detection of such samples in malware tests mainly depends on which AVs first encountered the sample in the wild. Many AVs can fight such malware similarly to Microsoft Defender (the first machine is infected, but others are protected after some minutes). Any two AVs can often miss different samples - we cannot assume that all samples detected by one AV will also be detected by another AV. That is why in good tests, several AVs should be tested at the same time on the same sample pool. Furthermore, for popular AVs, even 1000 fresh samples can be insufficient to get statistically significant differences.Edit.Microsoft recommends increasing the Cloud Protection Level and enabling ASR rules to maximize anti-ransomware protection.</blockquote>

[QUOTE="Andy Ful, post: 1117260, member: 32260"] If we forget about invalid testing methodology, this video can be an interesting demonstration of (possibly) new ransomware. The sample missed in the test was submitted to Virus Total one day before the test and was poorly detected by other AVs. Interestingly, in the test, it managed to encrypt only some files. We cannot exclude the possibility that the ransomware was detected post-execution (that is how "Block at first sight" works in Microsoft Defender for some unknown samples). Generally, I like this video demonstration (not a real test). The author tried to be neutral in his comments. Microsoft Defender missed 1 per 98 samples (the "test" was unfinished) which could often happen for any popular AV. So, I cannot say that this demonstration bashes Microsoft Defender. The detection of such samples in malware tests mainly depends on which AVs first encountered the sample in the wild. Many AVs can fight such malware similarly to Microsoft Defender (the first machine is infected, but others are protected after some minutes). Any two AVs can often miss different samples - we cannot assume that all samples detected by one AV will also be detected by another AV. That is why in good tests, several AVs should be tested at the same time on the same sample pool. Furthermore, for popular AVs, even 1000 fresh samples can be insufficient to get statistically significant differences. Edit. Microsoft recommends increasing the Cloud Protection Level and enabling ASR rules to maximize anti-ransomware protection. [/QUOTE]

Verification