Go To Home
Schedule a 1:1 Demo

Malware Detection is a Failing Strategy

by Smokescreen Team

Malware detection is a whack-a-mole game. Like the mythical hydra, when you chop off one head, three more appear, But that’s just half the issue.

Bypassing anti-malware systems is so trivial that attackers don’t treat it as a major obstacle. Even newbie pen-testers know how to go from off-the-shelf malware to “fully undetectable”. Believe me, the attackers have it automated, and commoditised.

Worse still, savvy attackers don’t even rely on malware to accomplish their mission objectives. Nowadays, they get by fine with:

Powershell
Provides practically any functionality an attacker wants. See the exemplary work by Matt Graeber on Powersploit and  Nikhil Mittal with Nishang. When you can build tools on the box, why risk dropping a binary?

Legitimate administrative tools
Teamviewer, pstools, AmmyAdmin and the like. Organisations use these tools to legitimately administer their systems. Well, so do modern attackers. You’re unlikely to find an anti-malware solution that takes a chance blocking something that might be a critical tool for your IT ops team. Attackers know and exploit this free pass. Application white-listing, sandboxing, heuristics, and signatures all go for a toss.

Stolen credentials
The FIN-4 APT attacks exemplify how devastating malware-free attacks can be. Through the use of stolen credentials and legitimate access channels alone, an attacker has more than enough to succeed.

Dmitri Alperovitch of CrowdStrike said it well in his recent article:

Malware is responsible for only 40 percent of breaches and external attackers are increasingly leveraging malware-free intrusion approaches in order to blend in and fly under the radar by assuming insider credentials within victim organizations… Once the adversary was inside the network, they were able to move around using legitimate credentials and windows system administration tools, without actual use of malware.

As we said in the beginning, malware detection is a failing startegy. Stop solving the symptoms, and start solving the problem.

#malware#strategy

Continue Reading

  • Open Source Honeypots That Detect Threats For Free

    If you’re a target for either financially motivated cyber-criminals, or nation-state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker.
    By Smokescreen Team
  • 7 Ways to Fail At Implementing Deception Technology

    Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.
    By Smokescreen Team
  • 10 Questions To Ask Deception Technology Vendors

    Deception technology is a major buzzword today. In order for you to cut through the marketing hype, here’s a set of evaluation questions that will help you better understand disparate deception offerings and identify vendors that know what they’re doing.
    By Smokescreen Team
  • Have you tried out IllusionBLACK yet?
    • Detect zero-days, APTs, and insider threats
    • 10x the detection capabilities with 1/2 the team
    • Get started in minutes, fully functional in hours
    Schedule a demo

    Smokescreen builds simple, no-nonsense products that security teams love. We help you predict attacks, detect breaches, and respond in real-time.