Reply to thread

Message

<blockquote data-quote="Decopi" data-source="post: 1044013" data-attributes="member: 67091">[USER=99014]@Trident[/USER] , please allow me simple questions from my very ignorant side:1. If Sophos engine is capable of handling password-protected zips, can we infer that ZAESNG based on Sophos engine is capable to do the same? Or not necessarily? To be based on a Sophos and Kaspersky engine means to have same capabilities as Sophos and Kasperky engines have?2. Here in this thread, are you always using ZAESNG in your tests? Or sometimes you use Harmony EndPoint?3. Your attached forensic images are from Harmony EndPoint? Or from your ZAESNG at C:/Program Data/Check Point/Endpoint Security/Threat Emulation/Reports?Yeah, it&#039;s another great way to test. Besides the fact of giving you a full and better comprehension, few samples every day also offer high quality tests because reflect zero-day-attack responses or at least reflect latest pest protection capabilities.4. What about connections? Sorry to ask, it&#039;s not totally clear to me, &quot;terminate&quot; means that the stealer started (and only then was terminated). So, it sounds that the stealer wasn&#039;t stopped or blocked to run. If that is the case, did the stealer manage to make any connections? Or the stealer never ran at all, nor succeeded to make connections etc?</blockquote>

[QUOTE="Decopi, post: 1044013, member: 67091"] [USER=99014]@Trident[/USER] , please allow me simple questions from my very ignorant side: 1. If Sophos engine is capable of handling password-protected zips, can we infer that ZAESNG based on Sophos engine is capable to do the same? Or not necessarily? To be based on a Sophos and Kaspersky engine means to have same capabilities as Sophos and Kasperky engines have? 2. Here in this thread, are you always using ZAESNG in your tests? Or sometimes you use Harmony EndPoint? 3. Your attached forensic images are from Harmony EndPoint? Or from your ZAESNG at C:/Program Data/Check Point/Endpoint Security/Threat Emulation/Reports? Yeah, it's another great way to test. Besides the fact of giving you a full and better comprehension, few samples every day also offer high quality tests because reflect zero-day-attack responses or at least reflect latest pest protection capabilities. 4. What about connections? Sorry to ask, it's not totally clear to me, "terminate" means that the stealer started (and only then was terminated). So, it sounds that the stealer wasn't stopped or blocked to run. If that is the case, did the stealer manage to make any connections? Or the stealer never ran at all, nor succeeded to make connections etc? [/QUOTE]

Verification