3 ms·

Windows Defender doesn't have heuristics/behaviour based detection. For example, if you write a simple keylogger using the Windows API in C++/Python/..., compi

by 323 5y ago

Windows Defender doesn't have heuristics/behaviour based detection. For example, if you write a simple keylogger using the Windows API in C++/Python/..., compile it and run it, an antivirus like BitDefender will block it by default. It's up to you then to allow it or not. So it can sometimes detect and block unknown malware, a thing that Windows Defender can't. So for some people it might make sense to have a more "strict" antivirus.

fletchern 5y ago
> Windows Defender doesn't have heuristics/behaviour based detection. Yes it does, in fact mpengine has a built-in JIT compiler for converting executables that it's scanning into safely-runnable executable code within its sandbox environment (done for performance reasons, rather than simply emulating them).
mrits 5y ago
Well that isn't true.
unnouinceput 5y ago
1st - that "heuristic" used by BitDefender or other AV solutions are simply scanning the .exe for those APi calls. This is easy to overcome by simply encrypting with even a simple XOR and dynamically loading said API's for keylogging (I suspect you are referring to SetWindowsHookEx - the most used API loggers, malware or not). 2nd - BitDefender is a Romanian AV, but people forget that Windows Defender is Romanian too, at its heart, the formerly RAV (Reliable AntiVirus) that Microsoft acquired it in the ancient times of early 00's. See: https://en.wikipedia.org/wiki/GeCAD_Software https://en.wikipedia.org/wiki/GeCAD_Software and https://www.networkworld.com/article/2334189/microsoft-to-buy-romanian-antivirus-company.html https://www.networkworld.com/article/2334189/microsoft-to-bu... 3rd - BitDefender is the most hog resource AV. Also the most annoying. And it behaves like is the only application you are need it, constantly begging attention. I worked at a company who had it as license, I hated every day there only because of it. Windows Defender on the other hand is so quiet that I always forget is running. My 2 cents.
- aetherspawn 5y ago
  According to this site [1], Bitdefender is amongst the most efficient antivirus packages for passive slow-down, and I can confirm that this has been my experience running an engineering firm that uses their enterprise security product, Bitdefender GravityZone. If you solve for efficiency (effectiveness over performance), Bitdefender has one of the highest detection rates (over 99.9%) and lowest false positive rates in the industry, making the effectiveness-performance ratio very impressive. Many other A/V packages are bigger hogs and yet detect less malware, with more false-positives. I'll admit their interface isn't great, but they did a refresh recently in their Enterprise product and now it's much more subdued (finally). They also changed their branding from bright Red to White, so it doesn't pop in the taskbar as much as it used to. It's worth noting that Windows Defender is amongst one of the only AVs that scores as effective as Bitdefender, but from my research it seems like Bitdefender's predictive engine is significantly better in benchmarks at fighting new/novel malware. Is it worth the approx. $100/yr? Not sure. I have considered canceling our subscription to Bitdefender and using Windows Defender, as the premium offering is already included in our Office365 licensing.. but I think that obscurity (using a non-standard security product) could be a defense in itself. [1]: https://www.tomsguide.com/us/av-software-least-system-impact,review-6276.html https://www.tomsguide.com/us/av-software-least-system-impact...
  - icare_1er 5y ago
    No later than a few days ago, as I was refining my exploit, this is the detection rate I could get too: https://i65.servimg.com/u/f65/15/63/53/97/pasted10.png https://i65.servimg.com/u/f65/15/63/53/97/pasted10.png I often end up not being able to bypass ESET32, although bypassing Bitdefender and others, is much easier.
    - aetherspawn 5y ago
      What is your experience with SOPHOS or other hardware firewall products? Are they effective at blocking novel malware?
AussieWog93 5y ago
I can say for certain that my software has been picked up by Defender's heuristics, and fixed within a matter of hours when I flagged it as a false positive. Kaspersky, on the other hand, still refuses to even look at any executable larger than 50MB.

by 323 5y ago

fletchern 5y ago

> Windows Defender doesn't have heuristics/behaviour based detection. Yes it does, in fact mpengine has a built-in JIT compiler for converting executables that it's scanning into safely-runnable executable code within its sandbox environment (done for performance reasons, rather than simply emulating them).

mrits 5y ago

Well that isn't true.

unnouinceput 5y ago

1st - that "heuristic" used by BitDefender or other AV solutions are simply scanning the .exe for those APi calls. This is easy to overcome by simply encrypting with even a simple XOR and dynamically loading said API's for keylogging (I suspect you are referring to SetWindowsHookEx - the most used API loggers, malware or not). 2nd - BitDefender is a Romanian AV, but people forget that Windows Defender is Romanian too, at its heart, the formerly RAV (Reliable AntiVirus) that Microsoft acquired it in the ancient times of early 00's. See: https://en.wikipedia.org/wiki/GeCAD_Software https://en.wikipedia.org/wiki/GeCAD_Software and https://www.networkworld.com/article/2334189/microsoft-to-buy-romanian-antivirus-company.html https://www.networkworld.com/article/2334189/microsoft-to-bu... 3rd - BitDefender is the most hog resource AV. Also the most annoying. And it behaves like is the only application you are need it, constantly begging attention. I worked at a company who had it as license, I hated every day there only because of it. Windows Defender on the other hand is so quiet that I always forget is running. My 2 cents.

aetherspawn 5y ago
According to this site [1], Bitdefender is amongst the most efficient antivirus packages for passive slow-down, and I can confirm that this has been my experience running an engineering firm that uses their enterprise security product, Bitdefender GravityZone. If you solve for efficiency (effectiveness over performance), Bitdefender has one of the highest detection rates (over 99.9%) and lowest false positive rates in the industry, making the effectiveness-performance ratio very impressive. Many other A/V packages are bigger hogs and yet detect less malware, with more false-positives. I'll admit their interface isn't great, but they did a refresh recently in their Enterprise product and now it's much more subdued (finally). They also changed their branding from bright Red to White, so it doesn't pop in the taskbar as much as it used to. It's worth noting that Windows Defender is amongst one of the only AVs that scores as effective as Bitdefender, but from my research it seems like Bitdefender's predictive engine is significantly better in benchmarks at fighting new/novel malware. Is it worth the approx. $100/yr? Not sure. I have considered canceling our subscription to Bitdefender and using Windows Defender, as the premium offering is already included in our Office365 licensing.. but I think that obscurity (using a non-standard security product) could be a defense in itself. [1]: https://www.tomsguide.com/us/av-software-least-system-impact,review-6276.html https://www.tomsguide.com/us/av-software-least-system-impact...
- icare_1er 5y ago
  No later than a few days ago, as I was refining my exploit, this is the detection rate I could get too: https://i65.servimg.com/u/f65/15/63/53/97/pasted10.png https://i65.servimg.com/u/f65/15/63/53/97/pasted10.png I often end up not being able to bypass ESET32, although bypassing Bitdefender and others, is much easier.
  - aetherspawn 5y ago
    What is your experience with SOPHOS or other hardware firewall products? Are they effective at blocking novel malware?

AussieWog93 5y ago

I can say for certain that my software has been picked up by Defender's heuristics, and fixed within a matter of hours when I flagged it as a false positive. Kaspersky, on the other hand, still refuses to even look at any executable larger than 50MB.