Activities Virus Control Improved


Been to own tests, AVC and IDS are unable to monitor the following malicious behavior, in order to help improve the AVC and IDS, I propose the following behaviors hope improved. Thank you


Behavior Description: inject code, modify EIP execute their own code, perpetrating a fraud, so that users considered normal process


For example:% WINDIR% \ explorer.exe of Explorer.exe of


Behavior Description: After running delete itself.


Behavior Description: tampering with system files


This AVC unable to detect:% system% \ config \ system.LOG


Behavior Description: Disable Registry Editor


Behavior Description: Disable Task Manager


Behavior Description: Modify function entry point attribute to writable


This AVC unable to detect: ws2_32.dll getaddrinfows2_32.dll gethostbyname!!


Behavior Description: inline hook own process


This AVC unable to detect: xxx.exe WS2_32.dll gethostbyname Ordinal:! 52 HookType: InlineHook


Behavior Description: using the global message hook injected into other processes specified file


This AVC unable to detect:% system% \ ftpdll.dll


Behavior Description: Create a common file system of the same name, suspected of hijacking the normal file system, common in virus behavior


This AVC unable to detect: [shell] - explorer.exe

Comments

  • Hi. I am not entirely sure about this but I think you're referring to File Integrity Monitoring here, not Intrusion Detection. Please correct me if I'm wrong. 1.gif

Leave a Comment

Rich Text Editor. To edit a paragraph's style, hit tab to get to the paragraph menu. From there you will be able to pick one style. Nothing defaults to paragraph. An inline formatting menu will show up when you select text. Hit tab to get into that menu. Some elements, such as rich link embeds, images, loading indicators, and error messages may get inserted into the editor. You may navigate to these using the arrow keys inside of the editor and delete them with the delete or backspace key.