Reply to thread

Message

<blockquote data-quote="Terry Ganzi" data-source="post: 953141" data-attributes="member: 18831">MSITC WiseVector StopX AI based detection and prevention of APT simulation1. APTSimulator from NextronSystems was used, which can be downloaded from Github (<a href="https://github.com/NextronSystems/APT" target="_blank">https://github.com/NextronSystems/APT</a>...).2. The simulator stops the program execution for some options. I did not investigate further on why this is the case.3. I skipped option 3 &quot;Credential Access&quot; because my virtual test machine then hardly reacted.But the used tool ProcDump from Sysinternals was detected as suspicious/malicious by WiseVector StopX and was blocked.4) It should be obvious that WiseVector StopX does not raise an alarm for actions like adding user accounts to local groups, because these are legitimate actions. The reloading of malicious code, e.g. in &quot;Defense Evasion&quot;, was detected and the malicious file was moved to quarantine.Network-oriented actions, such as the reloading of malicious Powershell scripts from the Internet, were detected and successfully prevented by HIPS or the firewall.In summary, WiseVector StopX does a very good job all things considered. The majority of the test sets were successfully detected and blocked. In my opinion, the AI capabilities of WiseVector StopX which are now reflected in all modules such as AV, HIPS or Firewall, are still very impressive. WiseVector thus impressively proves that not only the major players are capable of offering effective and efficient malware protection</blockquote>

[QUOTE="Terry Ganzi, post: 953141, member: 18831"] MSITC WiseVector StopX AI based detection and prevention of APT simulation 1. APTSimulator from NextronSystems was used, which can be downloaded from Github ([URL]https://github.com/NextronSystems/APT[/URL]...). 2. The simulator stops the program execution for some options. I did not investigate further on why this is the case. 3. I skipped option 3 "Credential Access" because my virtual test machine then hardly reacted.But the used tool ProcDump from Sysinternals was detected as suspicious/malicious by WiseVector StopX and was blocked. 4) It should be obvious that WiseVector StopX does not raise an alarm for actions like adding user accounts to local groups, because these are legitimate actions. The reloading of malicious code, e.g. in "Defense Evasion", was detected and the malicious file was moved to quarantine. Network-oriented actions, such as the reloading of malicious Powershell scripts from the Internet, were detected and successfully prevented by HIPS or the firewall. In summary, WiseVector StopX does a very good job all things considered. The majority of the test sets were successfully detected and blocked. In my opinion, the AI capabilities of WiseVector StopX which are now reflected in all modules such as AV, HIPS or Firewall, are still very impressive. WiseVector thus impressively proves that not only the major players are capable of offering effective and efficient malware protection [/QUOTE]

Verification