Go To Home
Schedule a 1:1 Demo

Malware Detection is a Failing Strategy

by Smokescreen Team

Malware detection is a whack-a-mole game. Like the mythical hydra, when you chop off one head, three more appear, But that’s just half the issue.

Bypassing anti-malware systems is so trivial that attackers don’t treat it as a major obstacle. Even newbie pen-testers know how to go from off-the-shelf malware to “fully undetectable”. Believe me, the attackers have it automated, and commoditised.

Worse still, savvy attackers don’t even rely on malware to accomplish their mission objectives. Nowadays, they get by fine with:

Powershell
Provides practically any functionality an attacker wants. See the exemplary work by Matt Graeber on Powersploit and  Nikhil Mittal with Nishang. When you can build tools on the box, why risk dropping a binary?

Legitimate administrative tools
Teamviewer, pstools, AmmyAdmin and the like. Organisations use these tools to legitimately administer their systems. Well, so do modern attackers. You’re unlikely to find an anti-malware solution that takes a chance blocking something that might be a critical tool for your IT ops team. Attackers know and exploit this free pass. Application white-listing, sandboxing, heuristics, and signatures all go for a toss.

Stolen credentials
The FIN-4 APT attacks exemplify how devastating malware-free attacks can be. Through the use of stolen credentials and legitimate access channels alone, an attacker has more than enough to succeed.

Dmitri Alperovitch of CrowdStrike said it well in his recent article:

Malware is responsible for only 40 percent of breaches and external attackers are increasingly leveraging malware-free intrusion approaches in order to blend in and fly under the radar by assuming insider credentials within victim organizations… Once the adversary was inside the network, they were able to move around using legitimate credentials and windows system administration tools, without actual use of malware.

As we said in the beginning, malware detection is a failing startegy. Stop solving the symptoms, and start solving the problem.

#malware#strategy

Continue Reading

  • The curious case of “How many decoys do I need?”

    Decoys can be deployed everywhere in your network – current-gen deception technology makes that possible. There are however no free lunches and pervasive deception might come with a cost. So the question is, should you?
    By Sudarshan Pisupati
  • Open Source Honeypots That Detect Threats For Free

    If you’re a target for either financially motivated cyber-criminals, or nation-state grade attackers, chances are your security team feels outgunned. Deception technology excels at detecting these attacks by shifting the cognitive, economic and time costs of the attack back onto the attacker.
    By Smokescreen Team
  • 7 Ways to Fail At Implementing Deception Technology

    Since there’s precious little information on how security teams can make deception implementations successful (some folks like to keep it a secret), there’s plenty that can go wrong. Here are 7 ways to completely botch your deployment of deception technology.
    By Smokescreen Team
  • Have you tried out IllusionBLACK yet?
    • Detect zero-days, APTs, and insider threats
    • 10x the detection capabilities with 1/2 the team
    • Get started in minutes, fully functional in hours
    Schedule a demo

    Smokescreen builds simple, no-nonsense products that security teams love. We help you predict attacks, detect breaches, and respond in real-time.