Reply to thread

Message

<blockquote data-quote="WiseVector" data-source="post: 786268" data-attributes="member: 76851">Hi [USER=56957]In2an3_PpG[/USER] ,1. The officially documented mechanism is not enough. There are a lot of API need to be protected, but you cannot protect them in kernel mode with PatchGuard enabled, especially in 64 bit. Actually, many AV (Comodo for example) hooks API in user mode even when they already have a kernel mode driver. They use APC to inject dll into a new process when driver gets notification.2. PowerShell is powerful, that&#039;s right. You can use&nbsp; P/Invoke to the Windows API. However, you cannot execute a PowerShell script by simply double-clicking on it. You need a loader (pe, js, vbs, etc.). That means AVs can block PowerShell malwares in the early stage.Our idea is to automatically extract complex patterns from a program&#039;s behavior graph, and then AI will decide whether to terminate this program at a specific point in time. The point is try not to wait until the malicious PowerShell code to run, and it will be implemented in the next version of WiseVector.RegardsEasonWiseVector</blockquote>

[QUOTE="WiseVector, post: 786268, member: 76851"] Hi [USER=56957]In2an3_PpG[/USER] , 1. The officially documented mechanism is not enough. There are a lot of API need to be protected, but you cannot protect them in kernel mode with PatchGuard enabled, especially in 64 bit. Actually, many AV (Comodo for example) hooks API in user mode even when they already have a kernel mode driver. They use APC to inject dll into a new process when driver gets notification. 2. PowerShell is powerful, that's right. You can use P/Invoke to the Windows API. However, you cannot execute a PowerShell script by simply double-clicking on it. You need a loader (pe, js, vbs, etc.). That means AVs can block PowerShell malwares in the early stage. Our idea is to automatically extract complex patterns from a program's behavior graph, and then AI will decide whether to terminate this program at a specific point in time. The point is try not to wait until the malicious PowerShell code to run, and it will be implemented in the next version of WiseVector. Regards Eason WiseVector [/QUOTE]

Verification