4 ms·
What type of "nasty stuff" did it stop? Are you talking servers or workstations here? How did that nasty stuff get far enough in that it had to be "stopped" by
by gregmac 7y ago
What type of "nasty stuff" did it stop? Are you talking servers or workstations here? How did that nasty stuff get far enough in that it had to be "stopped" by AV?
(I don't mean this to sound snarky, I'm genuinely interested in what type of real-world infections are happening and being detected. My experience is limited to internet-facing endpoints that have no security or are horribly outdated -- which is typically a bigger failure of IT to begin with -- and non-technical end-users running random executables from e-mails or shady websites)
- jm4 7y agoMostly crap that was targeted at users via email. Weird droppers, infected documents, PDFs loaded with some exploit. Lots of stuff that doesn't show up on Virus Total. We see a lot of stuff that attacks unpatched software and there's quite a bit that gets through the email gateway. We see frequent spear phishing scenarios where it's not uncommon for the attacker to email back and forth for a while under some pretext before delivering a malicious payload. Several situations where a party we are communicating with has been breached and the attacker will use them as a jumping off point to get to us - basically a business email compromise scenario where they jump into the middle of a conversation or document transaction with a malicious payload. We patch too, block a lot of connections at the firewall and have other layers, but it's nice when the endpoint protection stops it.