There's a lot of discussion of behavior based detections, but then it seems to lean heavily on AMSI, which is just an in-memory signature system. Even the sysc

There's a lot of discussion of behavior based detections, but then it seems to lean heavily on AMSI, which is just an in-memory signature system. Even the syscall monitoring, I wonder if it's really "Given a known sequence of suspicious syscalls" as opposed to "Given a known sequence of good syscalls" eg: signatures vs baselining. Or "These syscalls semantically amount to this behavior". From what I have seen of AMSI it's not much harder than classic AV to bypass. I appreciate the Fileless classifications - that seems like a larger value add, but I'd love to see us also better define TTP and Behavior based detections. It implies that we are observing generalized behaviors as suspicious when in reality it's almost always some sort of combination of predefined signatures. It is not a "behavior" (in a meaningful way) when an attacker uses specific parameters on powershell or some LOLBAS executable, it's just a very specific technique, which is subject to change. The higher level "Got a process to execute and do a thing" is what the behavior is, to me, and what we should detect. To be fair LOLBAS and Fileless are still uncommon approaches for malware, so it is not surprising that it's taking time to hammer out how we should be building out our view of the issue. Still, ATP is a great product, not trying to be overly negative. I think Microsoft is in a really good position to start hammering out the definitions for some of these concepts. I'll give this article another read I'm sure.