7 ms·
Because they want to check on the wire, before it hits an endpoint. Common situation is detecting malware sent through a phishing mail. You want to intercept t
by rocqua 2y ago
Because they want to check on the wire, before it hits an endpoint.
Common situation is detecting malware sent through a phishing mail. You want to intercept those before a user can unpack the file.
- canucker2016 2y agoAnd "Defense In Depth" - the more layers that bad actors have to avoid/circumvent reduces the chance of their success. see https://www.fortinet.com/resources/cyberglossary/defense-in-depth https://www.fortinet.com/resources/cyberglossary/defense-in-...
- alkonaut 2y agoYes that was my question: "why, do you want to do that when it sounds like a futile job to do?" If you have any kind of transformation (whatever trivial ROT or XOR) of the payload then there is no chance of detecting it via pattern matching, and if you need a "program" to process it into its malicious form, then how does detection work? I understand you want to keep malicious payload from reaching endpoints in a form that would risk being consumed (malformed documents, images causing buffer overflows, executable and script files). But beyond that?