Windows Defender is enough, if you harden it
0ut3r.space
0ut3r.space
We ended up absorbing and acquiring a few companies to provide a better offering and a lot of re-branding happened. For example Security Center's old portal for active threat protection, automatic remediation, incident investigation etc is all now absorbed into (the better) security.microsoft.com which is (to my understanding, just an engineer) the current and last (for the foreseeable future) rebrand. The team I work at started as one person working on the frontend for MDE (Microsoft Defender for Endpoint) and now has hundreds of people working on the security portal across India, Israel and the US (as well as a few other smaller sites contributing).
Also, as an engineer I have to say the offering is good. The anti-virus and the telemetry is worked on by some really smart people. Client information is sacred, logging into production takes multiple audits and PII is scrubbed (heavily) any time logs are needed. We still have a lot of room to improve but I am confident in Microsoft both delivering a good product and acting in good faith (and there is a clear business incentive in the enterprise security space to do so rather than benevolence).
A state level attacker can likely acquire 0-day exploits that are not patched and bypass defenses.
Microsoft's offering does some really cool stuff like:
- Automatically detecting anomalous behavior in the network and isolating suspected devices/ips/machines/programs.
- Have real time security engineers constantly monitoring your network and hunting attackers and suspicious activity.
- Tools that automatically isolate possible attackers and help measure the impact of attacks.
> Can we trust Microsoft to be neutral and offer security patches in a timely manner
Yes, that for sure. Once an exploit is discovered it is typically very quickly identified. A lot of the times security patches don't come from Microsoft though - if you consider something like Log4Shell (the Log4J vulnerability) for example.
> defend the interests of their consumer customers above all?
I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage.
> With the whole conflict in Europe, the issue of state level adversaries is raring its head again.
I think state level actors have consistently been a problem.
Note again as already mentioned none of this represents the opinion of my employer, just my thoughts.
cough NSAKEY cough
Provided a backdoor for state security forces. Did it in NT, and then even after they were caught, did it again in Win2k.
You underestimate people's moral flexibility, especially that of "patriots."
I'm sure on enterprise systems MS is pretty hands off. They've got a very stable cash cow there they don't want to scare away, but home users are probably screwed and you should expect that. MS has been making their opinion of their user's right to privacy and to control what their own computer very clear over the years. They've repeatedly demonstrated a willingness to leverage their OS against the users and their wishes for power and profit. Act accordingly.
Maybe things will be better with windows 11?
Let's be fair, naming is not a strength of Microsoft. It seems that every product other than Windows and Office is renamed every couple of weeks; and even in those two examples, explosions of SKUs manages to muddle the waters just as well (Apple's "Choose a Vista" was very much on-point, even if you preferred Windows over Mac).
If it wasn't "Monterey" and was just MacOS 12 there would've been no confusion. I feel like it's always an exercise of looking up the code name to find the version whenever someone is like "Yeah, I'm on Big Sur" .... ok one sec, let me google what that even means.
iPhone 10, Galaxy S7, RX470, such product names are significantly easier to keep track of.
Regardless, numbers are easier to work with, easier to remember, and it's immediately apparent what's going on with them. "debootstrap focal target" is more difficult to remember than a hypothetical "debootstrap ubuntu 20.04 target" would be. In practice I have to consult a chart almost every time.
But as someone in the UK random californian landmarks are inpossible to remember.
Numbers are best. Years are fine. Names are... Cute but Impractical.
Everything else is mostly reserved to Windows, including dotnet CLI tooling outcomes like trace and dump files debugging.
For tracing, well that means very different things to different people. One can capture most of the CLR level events that would go through ETW on windows with the `dotnet-trace` tool, which can also function as a primitive sampling profiler. But despite its name it does not use the profiling apis to implement a tracing profiler.
The analysis side of the dotnet-trace tool is subpar, but honestly even the best tools I can find often leave me underwhelmed on the analysis side.
Searching "Github Azure Edition" brings up this page[0]. That's the name of this promo page, and it talks about Github integrations into various Azure products. The very first product it talks about is Azure DevOps. Direct quote:
"Simplify deployment from your repository with seamless access to the Azure portal and Azure DevOps using your GitHub account credentials."
I can confirm that the parent comment you replied to is correct, as I used to work at Microsoft during the time when the renaming from Visual Studio Team Services to Azure DevOps was happening internally. As in, not that I was involved in it, but that we used VSTS, and then we noticed that the name was changing to Azure DevOps everywhere. All while we were still accessing the same service and all as before.
Though the parent point still stands valid, as Visual Studio Team Services indeed became Azure DevOps. Github hosted on Azure is just self-hosted Github and has nothing to do with VSTS/Azure DevOps.
…and “Windows” as well.
An actual name of a product I worked on at Microsoft
PS: And that function makes sense for "the public" don't you think?
Thats an awfully low standard to set don't you think?
I don't think it makes sense for the public. Stealing files from unsuspecting users without as much as a popup saying "hey, we just snatched this file without you knowing this is even a possibility" is just sad.
EDIT: i just realized you are being ironic
Im saying dubiously authorized because I bet no more than 5 out of a 100 windows users are aware this is even happening...
So no, this is not proof. At this point the lack of proof is near proof no backdoor existed.
At the risk of sounding tin hatty, not true. (In)Famy doesn't equal success or money, anyone attempting to post state secrets without the help of another state is probably not hard to intercept and buy off...
Anyways, there doesn't need to be proof - a (forced) system update straight from the source (Microsoft), targeted to your machine, is all it takes to make all security redundant, and there are enough publicly known phone home systems in Windows that we don't really need to prove they don't already dragnet.
I'll grant you, subverting corporate sec is a bit harder, but usually boils down to a bit of carfully targeted infil, put the right exceptions in the right corporate solutions, and corp security is also nill.
From reading the article everything "sounded right" but that's hardly an educated opinion since I only worked on _some_ parts of the product.
Actually - I think I'll ask our red team or security guid - that's also probably a good source.
Recently I looked at M365 business premium and thought that would only include Defender for O365 (why not M365?) and require a separate subscription for Defender for Endpoint, but now it looks like Defender for Business is included.
Anything being worked on the IO performance side of Defender? I’m still using a paid third party AV for this sole reason. The impact is so huge with NPM packages as an example…
Microsoft really needs to make this easier to turn off too. Right now, I have to use an undisclosed privilege escalation hack-around to force things my way.
Perhaps one ought to have live scanning enabled when updating packages, then disabled when not.
I look forward to seeing other replies.
What we really need is the ability to disable real-time scanning on one set of folders/extensions, while still including them with scheduled system-wide scans.
https://docs.microsoft.com/en-us/powershell/module/defender/...
https://docs.microsoft.com/en-us/powershell/module/defender/...
Or, even just run said folders as a custom scan!
`Start-MpScan -ScanType CustomScan -ScanPath PATH\TO\FOLDER-FILES`
Would you mind naming it? AFAIK most third party anti-malware solutions act like rootkits, possibly introducing new attack vectors, or have become basically ad-ware and malware themselves trying yo bait you in various subscriptions.
All AV somehow have to hook into low level system calls so can’t really avoid the kernel driver. Nonetheless, nod32 has been an install and forget AV with no interruption nor bait/nag screen at all. It’s a no bullshit AV and it does well.
I supposedly get the same protection as Defender (according to various AV tests review) and most importantly I get the IO performance back.
While I don’t doubt this true for Windows, on macOS Apple is phasing out kernel modules with APIs that allow software to hook into those low level calls without actually running in the kernel. For AV vendors there’s the Endpoint Security System Extension: https://developer.apple.com/documentation/endpointsecurity
All the AV/endpoint security solutions I’ve seen have switched to this.
It overall seems like a more complex solution that has more chances of being wrong. I would bet the core reason Apple did it was control to lock down their own control of your OS, not any security reason. Perhaps it also simplifies their development somewhat, if they can rid of some stability guarantees for some in-kernel APIs that AV would have needed.
I don't know much about the Endpoint Security extension, but for Apple's network filtering extension they actually DO address this!
The code that runs on every network call is heavily sandboxed and can't communicate at all with the outside. Its only action is emitting some basic signal like "block" or "accept". This means that while the system extension can evaluate all your network communication, and block what it chooses, it can't exfiltrate the specific content. I might have the details wrong, but that's the general intention.
But the security benefits aside, I think the real reason for preventing code from running in the kernel is about stability and not security. Buggy code won't crash the system anymore. They can also enforce stricter performance requirements.
(And at the moment, you can still run kernel extensions on your own system if you really want by disabling SIP and other things, it's just infeasible for any AV vendor to have their customers step through that very onerous process.)
McAfee is by far the worst offender IMO when it comes to file IO. We eventually dropped it in part to it's insistence on locking files in App Data which is a common scratch space for almost every Windows App.
These facts together mean that it should be really rare that any application needs to be waiting for any scanning - since scanning can happen anytime between a data write and a read of the same data.
Something like ZFS where hashing is baked into the cost of the FS operation could optimise this.
I know this because I did a bunch of reading on the topic after encountering catastrophic halts inside of CloseHandle, deep inside the kernel. And even with administrator privileges I could not kill the process, or the attached debugger, and the machine was unable to shutdown because even it could not kill the stuck process. I had to hard power cycle to get back to a usable system. Near as I can tell this was because of the AV product the company was using that crashed or deadlocked or something.
Note this product was not Windows Defender.
https://www.bleepingcomputer.com/news/microsoft/malicious-np...
As long as you guys are not going the route of google's approach to messaging, I'm sure we will forgive you. Nor the route of an NFC pay/wallet/money app that...
You know what? Just don't do the thing where you launch products to consumers so that someone achieves a promotion internally, and then abandon the product.
Frankly, MS has a long history of backwards compatibility, so signs are already positive.
I’m going to call you out on that. Microsoft lost my trust to act in good faith with personal data when they started capturing my private OS user input (e.g. the history from Windows R (run) and forced me to link it to my personal identity.
If they are doing a keystroke logger (ie, capturing typed private user data) where are they logging this keystroke log too? Or is the run command history sent up?
Are you talking about folks with Send my activity history to microsoft checked?
I have a script that sets default privacy preferences to my own preference when I start using a machine, you might consider that.
Then you will probably notice that you no longer have a history for Win+R run history.
It’s not unique to Windows to mine user input but it’s more recent than for example the search in iOS and less obvious than Google search.
I believed that the “personal” in Personal Computer meant that it belonged to me, and that used to be true. We are sliding down the slippery slope of allowing the software vendors to own our devices.
I think the staring point with Windows was product activation in XP, and that was quite legitimately intended to stop software licence abuse. I am still comfortable paying for closed source software but Microsoft seem to have given up on that business model.
Source? Searching for "windows run dialog telemetry" on google turns up this thread https://news.ycombinator.com/item?id=28598474, which has multiple people saying they can't reproduce it, and the author retracting the post: https://news.ycombinator.com/item?id=28608540
It’s also quite easy to observe that when you type anything into the start search interface you are steered or defaulted to searching Microsoft internet services.
1. Okay, but how's that relevant to my original question? Is the history being broken supposed to be smoking gun evidence that windows is sending your "history from Windows R (run)" to microsoft?
2. I just tried and failed[1] to reproduce this on a VM with a fresh install of Windows 10 Enterprise LTSC 2019 with "telemetry disabled". There isn't an universal standard for "telemetry disabled", but at the very least I have the "Allow Telemetry" and various search related group policies activated. I suspect what's happening is that you ran one of those "disable telemetry scripts", and that unintentionally broke it.
[1] https://i.imgur.com/WkbnBlM.png
>It’s also quite easy to observe that when you type anything into the start search interface you are steered or defaulted to searching Microsoft internet services.
but we were talking about the run (windows-R) dialog, not the start menu?
I am 100% certain that’s not the case. — Yes - the point is when setting all the most private privacy options on Windows 10 stops keeping a win+r run history. I didn’t go as far as installing a custom root CA and intercepting binary telemetry data to prove that the data was being sent. I think the fact that the MRU list is disabled strongly suggests that the product team assumed or new that it was collected.
If your experience is based on LTSC Windows/Office you probably have a different experience.
I don't want to minimize that, but I do want to (gently, good-naturedly) say that I think it's kinda funny.
As someone who once worked at a big tech company I think it's totally hilarious how telling people "I work on X product at Y company" totally evokes this sort of response. Tell enough people where you work and you'll see some non-zero percentage of people respond like this.
Like, when I was talking with a mover who was unloading my stuff and he asked "So, what brings to you these parts?" and I told him his first response was "Really? Y'know, I've got that software and it doesn't work for me under these very specific conditions. Why is that?" (At the time I think I mumbled something about "I don't know". In retrospect I was moving to start work there so I realistically couldn't have known yet).
So - I hope you get your problem sorted out, thank you for giving me the opportunity to talk about this, and I think I'm gonna go chase some kids off my lawn now :)
"Sure I can look at that, bring it into the shop, we're open eight to five Monday through Friday, eight to two on Saturday, and open until eight PM on Wednesday and Thursday, but only for drop off, pick up, and tire changes."
In all cases there are workarounds - I'm not using the Windows version (I'm on a mac) but when I had a performance issue it ended up being a script that created and deleted thousands of files quickly and tweaking it was fairly simple.
The name changes don't hurt anything. I just say Windows comes with AV built in and it does a fine job all on its own.
MS really did well with it.
If you need to point this out, I get the feeling it's not. You are only saying this because a boss told you to do so. Is what I'm feeling from this.
But bloody please add an option to turn off hunting for "hack tools". As an advanced user, SMB admin and private programmer I use NirSoft tools and also keygens for my own apps but Windows vigorously deletes NirSoft (and perhaps some SysInternals also, but I'm not sure) tools and every keygen it would notice. So I have to disable it. It has even deleted qBitTorrent once although it is a perfectly legitimate app and I use it to download legal things like Linux distros and legitimately purchased Humble Bundle stuff.
Why can't I [with reasonable ease] configure it to only watch for real viruses/spyware/ransomware which really threatens to infect the PC?
In my opinion we even have to consider actual pirates using really illegal keygens because this simple fact: there are many of such in mediocrely developed countries, they get confused, disable the protection, get infected and join the botnets. Even when there is a criminal we dislike to support and want to punish, we don't want them to get infected with anything and spread the infection further.
There should be clear distinction between unquestionable malware everyone wants and needs to be protected from for everyone's good vs questionable apps some people (justifiably or not) actually want to use for sake of their pragmatic interest.
Can you or anyone else help resolve this?
Think that Microsoft could do better with its false-positive review process, particularly doing something more for open-source developers and projects.
It is absolutely embarrassing and horrible. A bad, unusable system.
Fortunately I replaced all Windows machines with actual operating systems, so I do not have to use that ugly joke system too much.
https://www.theverge.com/2021/3/8/22319934/microsoft-hafnium...
In quite a few cases, we identified that ultimately a server has been popped using this unknown zero day, but never before seen webshells and Cobalt strike droppers all ended up dropped on servers and then deleted by Windows Defender. We recommended rebuilds regardless but the product clearly provided more security than people give it credit for.
Then we identified a number of places it didn't appear to work. Why? The answer was people following "best practices" of adding AV exclusions for the whole web root folder, and for some reason the whole user profile folder.
That big Kaseya hack? Every Kaseya user was told by Kaseya to add exclusions for every folder used by the product.
One of the understated issues with modern EDR products is people simply following vendor advise and making it useless. I've got a software product that handles payment details that randomly drops EICAR test files in random folders all of the user PC while it's running just so it can shut itself down if it detects Defender in use "for support reasons".
All the top EDR products in the world and all the hardening advice you can find can go down the toilet pretty quickly if you let vendors tell you how to run these products - ignoring them is a highly rated hardening tip.
There's a reason they're paid for doing so. If it was beneficial they'd do it for free.
I’m sure that there are other reasons - do you have any in mind?
In a business environment I've always been an advocate of staging one machine taking a drive image and using that image to clone the rest. Resolved so many issues if the end-user mucks up their machines so bad you just reflash the drive image and send them on their way.
Given how many devices use out of the box drivers, combined with the amount of drivers distributed with Windows update, that part of the story has gotten much better as well.
Also there are features that allow downloading the install image from Microsoft servers similar to what Apple has had for years. But this might be a enterprise customers only feature.
One caveat is that SCCM is not free, and we have a dedicated guy managing it. Not sure how much work that entails (he's not full-time), I rarely if ever touch our Windows environment (I'm running Linux on my own machine).
Still hate the shovelware. If it were a good product I would choose to install it.
Sadly that's discontinued now as Windows descends further into consumer abuse and anti-features. https://www.howtogeek.com/402888/looking-for-a-microsoft-sig...
But surely windows will activate defender? Since any AV must register in windows and considering that MS isn't exactly known for respecting user wishes I'd expect defender to start up the same nanosecond any other AV stops.
Though I'd never out myself in a position to test that.
I run Glasswire [1] which started as a detailed bandwidth monitor but now has a firewall feature that sits on top of Defender and works with the rules list so not trying to replace anything.
Its simple and adds the biggest win in this article's list of recommendations imho which is Block on Fist Sight. In addition to asking, Glasswire also checks every new or updated network service requestor's VirusTotal score. No Group Policy or PowerShell magic required.
[1] www.glasswire.com
Taking a quick look MAPS block at first sight, it appears to look at both the executable file and non-portable executable files such as JS, VBS, or macros, then stop execution, however it isn't clear if this also includes things such as dll files or the python script being executed by python.exe.
The firewall feature of GlassWire, or any application level firewall will only block traffic for your typical, well behaved programs, to save some bandwidth, and possibly block some telemetry if the program isn't too mischievous. This is because GlassWire doesn't stop the program, and can't tell if you're the one running the executable or another application is running it programmatically, so if EvilApp.exe notices it can't connect to the internet, it could just use something innocent you've allowed such as Firefox or python to send/receive data on its behalf (or just do that from the start).
This is why it's still important to check the bandwidth of programs you trust for abnormalities, even if you've only allowed trusted programs and block everything else, and why it's so important to keep programs up to date and only run stuff you don't fully trust in a sandbox (since I doubt MAPS block on first sight is perfect either).
With Office 365 ATP, things get even slower, too, which is not so great on my work device.
Detection rate is one thing. Performance is another. Both are important.
These memory-type debates come up time and time again. Keep in mind I'm a programmer from the DOS days, note my user name on when this was an important issue. We had to cram every byte.
These programs will use idle RAM as they see necessary to be performant. If you aren't using the RAM, why not actually use it for what it's for?
Are you under memory pressure? How many GB of RAM do you currently have and how often are you capping it out? Try seeing what happens when you are at your GB RAM cap.
"I don't think that's appropriate" is highly subjective and it depends on what it does, and what you are currently doing.
If there was one, it would be fine.
How do I tell the system which of them I prefer (or some rank), instead of letting them fight it out, each of them thinking that they are the process entitled to all the perks of the currently unused memory?
Nothing is "fighting it out", there are internal heuristics to understand what applications need that RAM.
This is an internal OS feature of modern operating systems. If you are not capped out on RAM usage, this point is moot. If you are truly running at the RAM cap, to where the OS is paging out memory to disk and you have contention, you need more RAM.
My point was that there isn't one distinguished process, and that thus -- as you described -- it should be left to the OS to decide and not to Windows Defender.
The AV doesn't need to take "free ram" except when it tries to guess what the OS will do with disk cache. But by putting it in the AV cache it then prevents other software from using the cache.
Just use the OS level disk cache.
Unlike linux[1], windows task manager correctly shows "cached" ram as "free" ram. Therefore it's highly unlikely that the memory usage is from the OS caching mechanism.
As for the actual behavior of using free ram, what happens if there are two apps that try to use the same behavior? ie. you have windows defender and a DBMS installed, both of them try to use up all the free ram. In this situation, what makes you think the behavior of "using all the available free RAM" behavior of windows defender wouldn't push out the "using all the available free RAM" behavior of the DMBS", leading to worse performance?
Windows has an infrastructure to prioritize memory availability by process, and to notify processes when there is physical memory pressure so that they can act accordingly. I'm not sure, but as a first-party component I would assume that Windows Defender uses these appropriately.
That said, like most real-time antivirus Defender does feel that it is important to complete real-time protection scans and will sometimes do so at the cost of performance. The logic here is that it is important to complete these scans even under conditions of resource pressure, otherwise malware could just do things like cause high system load before downloading a second stage in order to avoid Defender completing a real-time scan.
Unfortunately this does sometimes cause headaches, for example I saw a situation recently where someone ran a tool that opened a huge number of media files on a NAS in order to read their metadata. This resulted in Defender queuing up a real-time scan of probably over a TB over the network since it saw all of these 10GB+ files being touched, with a definite negative impact on performance. I still wouldn't give "exclude network mounts" as general advice as some people do, but that's an example of sort of a pathological case for real-time scanning where you probably want to exclude it.
Only the kernel should be grabbing "free" ram and allocating it for cache.
That's something I'd expect a database to do. A virus scanner? Not so much.
I think you can exclude certain directories from Defender scanning too.
Where's the explicit code in Defender which ensures it only does its' thing if the system isn't under heavy load?
Also, you do realize that if every program followed this pattern - it would cease to work?
Whenever I see a machine that's slow or sluggish during operation but reports that only 60% of it's resources are used, Windows Defender is usually the culprit. I've nerfed Windows Defender for performance reasons to the point that I wonder why I even bother anymore.
Does yarn use more than a single core? I've seen some analysis articles that a major root cause of the slowdowns here are that the scanning API is hooked into file close and scanning takes time, so if you have a straightforward open file, write to file, close file, repeat single threaded process, your throughput gets really limited. I don't think there's a Windows API for asynchronous close, but if you send the handle to a thread (pool?), that will get you much better results.
None of the resources in task manager (or the resource manager thing) will show anything being capped so it's hard to troubleshoot what system Defender stresses so much.
Yeah, task manger is missing the most useful feature of FreeBSD top, the state column that lets you know what the process was doing at the sample time. If you saw your installer was always in state close handle, you'd have a good guess. But it's a straight forward throughput problem; if it takes 1 ms to scan a file, and there's no concurrency or pipelining, then you're limited to 1000 files per second. If you can thread pool closing, you get a lot more throughput. Unfortunately, everything that runs on windows and expects to close lots of files needs to manage a threadpool to close, but usually developers don't get to pick their platform, their users pick.
I've got Windows Sandbox to try anything shady in and a decent firewall on the edge between me and the rest of the world, I generally don't worry too much.
I checked on 5 different machines, one of which is a corporate laptop, and every one showed Defender using 100-150MB memory. 3 of those machines have 64GB memory. My desktop (which has 48GB memory) has been on for a week, and is currently showing 135MB.
In my experience, Defender's resource usage is actually low by comparison to others. McAfee is the worst, by a long shot - fans spin constantly, it uses up to gigabytes or memory, and is a ludicrous CPU hog.
The idea that pushed me over the edge to try it again was that, this time, I'd try disabling Defender (as I was 1/2 convinced the Linux performance boost was not having AV) and keep a fresh/clean install strictly limited to Chrome (now that I had gotten used to just using the web versions of everything like Slack, Spotify, etc.), VS Code, WSL2 and that's it. Basically what I'd been doing with Linux. And so far that's been great - better performance, runs cooler and quieter, longer battery life etc. than I ever used to have with Windows. It is like a whole new machine.
Knowing I don't have Defender I am even more careful about what I download (these days almost nothing - especially on the Windows side rather than the WSL2 Ubuntu dev side) and about ensuring everything is patched. But it is such a game-changer I am not going back...
> Run this bat file!
Also this is another direct quote from the article:
> Reading some comments on random websites I guess you don’t even need a brain.
Coupled with the "just run this" batch file with no explanation... huge facepalm.
"Local Group Policy Editor is available only in pro/enterprise edition, but you can add it to the Home version of Windows too."
The last two lines are what actually enable the policy editor (by installing the Windows feature through DISM, the normal way). Still better than no batch file, but an explanation would indeed be nice.
Why the convoluted scripts to get admin? Why execing file with "~3" in the name when you can use the proper one? So much needles silly steps, too little actual explaining of anything that would matter.
Also, following that will just ensure you can never download curl or nmap lol. ...i guess, maybe i got the whole thing wrong. Who knows. I don't.
This. It reads exactly like (suboptimal) code comments or commit messages explaining what gets done but no trace of why. Why does this stuff harden defender? Why does it make Defender enough?
And attack surface reduction rules (which you must configure) - which greatly reduces office worker possibility of catching some nasty stuff:
Block abuse of exploited vulnerable signed drivers
Block Adobe Reader from creating child processes
Block all Office applications from creating child processes
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Block executable content from email client and webmail
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Block execution of potentially obfuscated scripts
Block JavaScript or VBScript from launching downloaded executable content
Block Office applications from creating executable content
Block Office applications from injecting code into other processes
Block Office communication application from creating child processes
Block persistence through WMI event subscription * File and folder exclusions not supported.
Block process creations originating from PSExec and WMI commands
Block untrusted and unsigned processes that run from USB
Block Win32 API calls from Office macros
Use advanced protection against ransomwareLet's say you're a journalist at an important news org. Even for your personal devices, the builtin defender isn't enough.
There is a fundamental principle for sophisticated actors, that prevention is not enough. Your security software should do monitoring (off device) and do that very well. You are already compromised, you should be looking into the collected data to see where, when and by whom so you can do something about it. Unfortunately in the last fee years the line has been getting very blurry between sophisticated nation state actors and criminals and common criminals trying to score as much loot as possible (mostly due to being forced to use sophisticated tools and techniques because solutions like Defender have gotten very good).
You maybe an average joe and still be a target for "sophisticated" actors or you may think you are an "average joe" but your pwnage offers a strategic value to someone resourceful,
My advice is to take inventory of the data and resources you have access to and see (with help if needed) what threat model fits your use case. MS does offer a Defender ATP that's basically turning on few more switches and sending them a log of everything happening your machine.
Back tracking a bit: Defender is really good. Cloud based protection is their secret sauce, turn it on and pretend they are to be trusted with collecting random files from your PC.
The downside is that for a while after you enable it, you will need to keep granting applications write access to those folders, until eventually all apps that need write access have it.
In a corporate environment, IT could pre-configure the white list to include any approved applications that need write access to those folders. Most companies claim that installing unapproved software is a fireable offence, so only the execs (who are immune to such policies) and developers are likely to notice.
Bypassing other AVs would really be a 'nice to have'
Further, AV is inherently a "catches known threats" technology, as much as any AV may pretend otherwise. Some people will always get owned but by virtue of those users' AV picking up samples the sample will eventually make it to various AVs.
If your goal is to avoid AV bypasses, I'd suggest changing your goals. Instead, treat AV as it is - a technology for finding known bad things. If you want to avoid unknown bad things you need to take another approach.
ANYTHING that touches lsass.exe, no matter how, will trigger AV these days.
Go and try to compile your own customized version of Mimikatz, unless you are malware developer, you will not manage to get one that doesn't get flagged.
I think sandboxes are better for software you don't trust. I imagine antivirus heuristics are only useful against a handful of common threats, if at all.
https://gist.github.com/superswan/1d6ed59e75273f90a481428964...
Aside from clearly aimed ransomeware, today's pretty difficult to have virus problems in Windows. Most of the time I have to repair any Windows machine is due to a driver install problem (specially sound cards) or a system update problem.
On the other hand, whenever I use a machine with an antivirus, I want to quit my job. Those things are slow. Very slow.
My work machine has a multitude of security software that I can't disable, heck, I can't even touch. Doing a pip install on a common program takes 10, 15 minutes. The same installation on my personal machine takes about one minute. The culprit? The 3 different agents that spins out of control scanning my disk.
EDIT:
In many cases, these security changes meant deep architectural changes were required to third party solutions. And most ecosystem vendors were not incented to invest heavily in their legacy apps. Some of these solutions took the unorthodox approach of modifying data structures and even instructions in the kernel in order to implement their functionality, bypassing APIs and multiprocessor locks, often causing havoc. At one point, something like 70% of all Windows “blue screens” were caused by these third party drivers and their unwillingness to use supported APIs to implement their functionality. Antivirus vendors were notorious for using this approach.
In my role as head of Microsoft security, I personally spent years explaining to antivirus vendors why we would no longer allow them to “patch” kernel instructions and data structures in memory, why this was a security risk, and why they needed to use approved APIs going forward, that we would no longer support their legacy apps with deep hooks in the Windows kernel — the same approach that hackers were using to attack consumer systems. Our “friends”, the antivirus vendors, threatened to sue us in return, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customers — the very thing they were supposed to be improving.
I think they definitely had a purpose a long time ago but probably not for the past 15 years.
Microsoft is also the biggest vendor of enterprise endpoint security solutions - that is Microsoft Defender and products like "Palo Alto Cortex" compete. However, the home offering of Defender _is_ quite different in terms of usage from the enterprise version and so is the amount of instrumentation.
for the first time, i have a machine with this installed and holy damn... it's so bad. it uses 30~50% cpu all the time + tons of IO. how can people just accept software that just degrades your machine for small gains on security?
when i try to use docker, tmux within a terminal, it gets even worse -- i've seen it using 60% cpu + io.
My requirements were simple: it had to run in our cloud (AWS, eu-west-2) because of PII concerns, preferably "serverless"/ephemeral and we needed to scan assets our data analysts would use in their day to day operations (tiny files, massive files - a bit of everything).
After a several time consuming days I had to give up because I found nothing. The Internet has become a mirage of av/malware scanning solutions that no longer exist (one of our guys reported that Sophos had a CLI tool - savscan - but when I looked it appeared to be discontinued). Almost every major vendor I came across offered an end-point product that ran on their cloud or had moved out of the malware/virus scanning market in favour of a DPI firewall. I was hampered by a lack of product documentation/feature comparison tables on the "enterprise" vendor marketing websites and sad "cloudification" of stacks that really ought to have a CLI binary.
These have absolutely massive issues with false positives that take ages to resolve even if reported.
Since then I just find the least obtrusive AV and just try to avoid clicking on anything suspicious, because I'm convinced they all offer "meh" protection at best.
I've had an incredible number of problems caused by antivirus software interfering with legitimate software.
This is like saying your blood pressure is fine, but you've never had it measured. :) Email and internet are still places of entry to machines. Plenty of 0-Day stuff out there your average person can stumble into.
Even the most paranoid and careful person could be pwnd by a vulnerability in their browser, network stack, GPU driver, or whatever. If you at any point open a network-connected application on a popular OS then you are at risk. It doesn't matter if you "don't click links," or "be careful what you download."
What?
Just do a reinstall of Windows every 2-3 months.
I have never seen a message saying "Defender does not recognize this application, are you sure you want to start it?"
Also there's a lot of downloadable Open Source software where users are asked to "verify the keys". Couldn't Windows do this kind of thing automatically, or at least make it easy?
https://docs.microsoft.com/en-us/windows/security/threat-pro...
What I'm thinking of is something where Microsoft would keep a publicly visible registry of all apps that have been submitted to the registry. It would be beneficial for both software produces and Microsoft as the platform producer. The registry would run all kinds of malware checks on it, and also keep an ear out for reports of threats found.
Looks really good, i'd like to create something similar for my site.
Blog is using Hexo (https://hexo.io/) and a little modified Cactus theme (https://probberechts.github.io/hexo-theme-cactus/). If some of the websites looks interesting to you and you would like how they are built you can use Wappalyzer (https://www.wappalyzer.com/)
It is enough for your average user though I'll give it that.
For example, if you write a simple keylogger using the Windows API in C++/Python/..., compile it and run it, an antivirus like BitDefender will block it by default. It's up to you then to allow it or not.
So it can sometimes detect and block unknown malware, a thing that Windows Defender can't. So for some people it might make sense to have a more "strict" antivirus.
Yes it does, in fact mpengine has a built-in JIT compiler for converting executables that it's scanning into safely-runnable executable code within its sandbox environment (done for performance reasons, rather than simply emulating them).
2nd - BitDefender is a Romanian AV, but people forget that Windows Defender is Romanian too, at its heart, the formerly RAV (Reliable AntiVirus) that Microsoft acquired it in the ancient times of early 00's. See: https://en.wikipedia.org/wiki/GeCAD_Software and https://www.networkworld.com/article/2334189/microsoft-to-bu...
3rd - BitDefender is the most hog resource AV. Also the most annoying. And it behaves like is the only application you are need it, constantly begging attention. I worked at a company who had it as license, I hated every day there only because of it. Windows Defender on the other hand is so quiet that I always forget is running.
My 2 cents.
If you solve for efficiency (effectiveness over performance), Bitdefender has one of the highest detection rates (over 99.9%) and lowest false positive rates in the industry, making the effectiveness-performance ratio very impressive. Many other A/V packages are bigger hogs and yet detect less malware, with more false-positives.
I'll admit their interface isn't great, but they did a refresh recently in their Enterprise product and now it's much more subdued (finally). They also changed their branding from bright Red to White, so it doesn't pop in the taskbar as much as it used to.
It's worth noting that Windows Defender is amongst one of the only AVs that scores as effective as Bitdefender, but from my research it seems like Bitdefender's predictive engine is significantly better in benchmarks at fighting new/novel malware. Is it worth the approx. $100/yr? Not sure. I have considered canceling our subscription to Bitdefender and using Windows Defender, as the premium offering is already included in our Office365 licensing.. but I think that obscurity (using a non-standard security product) could be a defense in itself.
[1]: https://www.tomsguide.com/us/av-software-least-system-impact...
https://i65.servimg.com/u/f65/15/63/53/97/pasted10.png
I often end up not being able to bypass ESET32, although bypassing Bitdefender and others, is much easier.
Kaspersky, on the other hand, still refuses to even look at any executable larger than 50MB.