Miałem o tym co ponizej napisać, „ale bzdury”
Przez delikatnośc nie napiszę.
Zawsze mi sie wydawało ze to robia firewalle.
Dowiedz sie co oznacza definicja virus, to moze jednak dowiesz sie że dalej sie je pisze.
Nie od biedy. Dowiedz się co to takiego.
Kaspersky twierdzi że to to „signature is a continuous sequence of bytes that is common for a certain malware sample. That means it’s contained within the malware or the infected file and not in unaffected files.”
Naprawdę. A ja myslalem ze dzisiaj pisze sie malware (nie slyszałes o czyms takim? 
)
Wyobraź sobie ze jest pewna róznica pomiedzy zainfekowaniem czegos a tym co zainfekowane coś zrobi.
To drugie to tylko końcowy efekt.
Jesli chodzi o heurystyke to dowiedz sie jaka jest róznica miedzy remote exploit a local exploit.
Co to zero-click. Co to fileless malware, LOLBins.
Dowiedz sie przez jak długi czas pliki pdf nie były skanowane przez zaden AV oprócz Ms Defender i jak to było bezpieczne ( dla ułatwienia, rok 2022)
Dowiedz sie co to takiego było Spectre i Meltdown.
Dowiedz sie jaki jest najpowszechniejszy system operacyjny na swiecie ( Nie Windows), zapytaj @wielkipiec . Pisał kiedys o nim w newsach.
Dowiedz sie jak to wszystko działa. Latwo nie będzie.
Na poczatek proponuje spojrzenie na logi farbara
Co do sprawnosći AV to dowiedz sie jakie firmy zgodziły się na Advanced Threat Protection Test 2021?
Tylko osiem
Miały przejśc to.
" The 15 test scenarios used in this test are very briefly described below:
- This threat is introduced via Valid Accounts. PowerShell Empire was used to create an HTA file that executes an included staged PowerShell payload.
- This threat is introduced via Trusted Relationship. PowerShell Empire was used to create a JavaScript script that executes a base64-encoded PowerShell payload.
- This threat is introduced via Trusted Relationship. A PowerShell script containing an AMSI bypass and a separate PowerShell Empire payload is used.
- This threat is introduced via Valid Accounts. The trusted Windows utility MS Build is used to execute a PowerShell Empire payload (including an AMSI bypass) by enabling a malicious macro.
- This threat is introduced via Valid Accounts. With a BAT file, an encoded and partly obfuscated staged PowerShell Empire payload is executed.
- This threat is introduced via Trusted Relationship. A PowerShell script that contains a PoshC2 payload and a separate AMSI bypass is used.
- This threat is introduced via Removable Media. An obfuscated PoshC2 PowerShell payload is executed by using Microsoft Office macros.
- This threat is introduced via Removable Media. A VBScript is used to execute a Base64-encoded PoshC2 PowerShell payload.
- This threat is introduced via Removable Media. A .LNK shortcut file is used to download and execute a heavily obfuscated PoshC2 PowerShell payload.This threat is introduced via Spearphishing Attachment. A VBScript is used to load and execute an obfuscated PoshC2 .XSL payload into the RAM of the client.
- This threat is introduced via Spearphishing Attachment. A clean x64 PuTTY executable, backdoored with a staged x64 Metasploit shellcode, is used.
- This threat is introduced via Spearphishing Attachment. A PE file, which uses the metadata of adobe.exe for masquerading, executes a Metasploit Meterpreter shellcode.
- This threat is introduced via Spearphishing Link. A JavaScript that executes a Metasploit Meterpreter shellcode by DLL sideloading is used.
- This threat is introduced via Spearphishing Link. A PE file, which uses the metadata of werfault.exe for masquerading, executes a XOR-encoded Metasploit Meterpreter staged shellcode.
- This threat is introduced via Spearphishing Link. A JavaScript script, which uses rundll32 to execute Metasploit Meterpreter shellcode by using DLL sideloading, is used."
Żadna nie przeszeszła całośći.
Zaproszono firmy AV w tym roku. Żadna jak dotąd zgody nie wyraziła.
