Collaborate Disseminate
Detection of change is easy… There, I said it. Anyone can do it. One thousand monkeys with keyboards can pound out scripts to detect change. What is not so easy, what the monkeys can’t do, is reconcile change. Even worse, it’s usually… Continue reading Developing an Effective Change Management Program
I’m working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida packed software and calling … Continue reading Detecting cracked Themida packed malware
One of the famous insults that security vendors use against competitors nowadays is “RULE – BASED.” In essence, if you want to insult your peers who, in your estimation, don’t spout “AI” and “ML” often en… Continue reading Rule Based Detection?
Whenever I read books or academic papers and the subject of heuristic malware detection is brought up they always say the same thing: “it can be either static or dynamic”, “it may use emulation”, “may detect new malware, but … Continue reading What are the heuristic detection techniques most often used in modern AVs?
Recent news articles have started to talk about government networks deploying “Albert sensors” (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it sounds like maybe an Alb… Continue reading What is an Albert sensor?
Outstanding, well-engineered solution to blind-spots in event-driven detection scenarios, via Matt Suiche, writing on the Comae blog. Fascinating.
The post Event-Driven Detection Blind-Spots, The Work Around appeared first on Security Boulevard.
Continue reading Event-Driven Detection Blind-Spots, The Work Around
Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ?
I know AV-Test and AV-Comparatives exist to test the effectiveness of these products, but I wa… Continue reading Assess anti-malware detection techniques
Super tired of Facebook locking my account after declaring it’s detected suspicious activity. Don’t want to use it at all, but pretty much have to. 🙁
Have 2FA turned on (Google Auth), so:
1) Not on the real FB. In fact, on … Continue reading Facebook AI constantly "Detects suspicious activity" = locked account
My father told me that he allowed the installation of apps from unknown sources when he was asked to do it to go further with something (he said that he doesn’t remember when or what he was doing).
In android 8.0 (the version of his smar… Continue reading Can my father’s smartphone be compromised?
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain mostly with C libraries … Continue reading Why malwares need to be light