3 ms·
So it’s been a long, long while since I’ve explicitly run AV software but doesn’t signature, heuristic, and behavior based detection all run locally on the mach
by mikeiz404 5y ago
So it’s been a long, long while since I’ve explicitly run AV software but doesn’t signature, heuristic, and behavior based detection all run locally on the machine?
I suppose the exception might be sandbox but from what I understand this is usually in a corporate environment where connections are MitM’d any way and potentially harmful files are run in a sandbox.
Am I missing something?
That being said I’m not sure very many would even notice files being exfilled by an AV especially if it were user targeted.
- NtGuy25 5y agoIt depends, but most consumer AV's upload. And alot of EDR's are implimenting cloud based detections, with the option for companies with IP risks to run an on prem version of their cloud server. A good example is this hackernews post from not long ago detailing how Windows Defender uploaded a beacon he made from a VM with no internet access (But connected to a LAN with his main computer) and exfiltrated it from there to Redmond and ran it, most likely in some automated scanner. https://news.ycombinator.com/item?id=21180019 https://news.ycombinator.com/item?id=21180019
- mikeiz404 5y agoWow that’s kind of alarming; I wouldn’t have expected that behavior from an OS provided AV (I would have assumed it would be more conservative) but maybe I shouldn’t be too surprised given the trends these days (and microsoft’s decisions with their recent OS’s too). Thanks for sharing.
- jenscow 5y agoPerhaps there are some heuristics/behaviours that cause a file to be uploaded for further investigation, to identify new threats.
- ev1 5y agoalmost every AV uploads files