I know how signatures are used to detect malware samples of already known malware and techniques to apply to use.

1.What are some of the different behavioral techniques used by antivirus/anti-malware ?

  1. If would want to use some behavioral techniques then how to use? like in the signature base we could directly take a file and on the basis of that scan files/process/etc.

closed as too broad by S.L. Barth, forest, iainpb, schroeder Feb 27 '18 at 11:23

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • There are a lot of heuristic techniques used by antivirus software. This is an incredibly broad question. – forest Feb 26 '18 at 12:52

There are common ways malware works - currently quite a few are using powershell for example to call out download the payload and execute. This is normally trigger from say Word.exe calling cmd.exe has then called powershell.exe with arguments.

So detecting if a process for cmd.exe has been created by word is an indicator of potential malware activity and has a child process of powershell.exe.

Now there are quite a few common attacks that have indicators such as these listed by mitre: https://attack.mitre.org/wiki/ATT%26CK_Matrix

Given known attack types you can detect this behaviour and respond. If you start grouping the different types of chained attacks you would expect you can determine if to a certain degree if something is malacious. A good example of a tool that monitors for malicious behaviour is sysmon

Sysmon can be configured to only look for certain types of behavior and writes to the windows event log.

Obviously if a new attack category with new indicators this becomes a problem. So now you also begin to determine what is normal behaviour on a system using some ai techniques so if something out of the normal occurs it can be flagged and other indicators looked at.

Not the answer you're looking for? Browse other questions tagged or ask your own question.