I was looking into implementing a security measure by adding false analysis tools / signatures on client PC's.

The idea is that certain malware would scan the environment for analysis tools, and if the malware is hardened, it will terminate itself before it can be analysed.

If I implemented this, would it be considered a viable solution for certain types of malware, and also how practical would this be for an enterprise environment?

Note: this is a part of Minerva's Hostile Environment Simulation, but I only wish to use this piece and potentially just push out these false tools / signatures as updates to the client PC's.


I say that less than 1% of malware does sandbox / av / whatever-detection.

I recently processed ~ 20k malware samples from https://virusshare.com/ as part of a machine learning project. I had to partially reverse a lot of them, etc. i was appalled at the horrible quality of your average malware. I saw only a handful of samples check their environment.

My guess is that your energy is better spent elsewhere (better endpoint monitoring, etc.).

  • 1
    A lot of malware is so bad that it even leaves debugging symbols included!
    – forest
    Mar 23 '18 at 3:27

This is done, in a way. The WannaCry malware for example checked whether or not the domain iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com was registered and could be resolved. If it was present, the malware shuts itself down. The domain was registered in order to slow the spread of the malware.

Other malware may check for the presence of a certain file on the computer. If the file is present, the malware will terminate itself. This is sometimes done to prevent multiple simultaneous infections, and is sometimes done as a lazy way for the malware author to neutralize it on their own systems.

So why do antimalware systems not populate your computer with these signatures? Simply because, if the malware is known in advance, it is far easier to simply block it directly with signature-based detection. As for opportunistically placing debugging tools on the system to fool the malware into thinking it is being analyzed, simply not enough malware attempts to detect that. It would not be a cost-effective approach compared to, say, hardening your system. Another reason is that some malware detects debugging by spawning a child and mutually debugging each other, as only one debugger can be attached to a process at any given time. Fooling this kind of anti-debugging behavior would require attaching a debugger to every program that executes, in hopes that one of them will be malicious and will summarily terminate itself.


It's an interesting idea. We know that some malware looks for processes running and self-terminates to avoid detection. Unfortunately, not all malware does that.

There's also a tradeoff to consider. There may be a licensing cost associated with the tool used as well as resources consumed with malware prevention.

Most importantly, what are you trying to protect? Client PCs? Servers? Manufacturing devices? The protection scheme for these all differs.

I wouldn't rely on this as the only solution or even a solution for certain types of malware. It would stop certain pieces of malware but that's an ever-evolving threat and a pretty vast universe.

I wouldn't call it impractical but I would say it's of limited utility.

  • We are trying to protect client PC's, and this will be used in addition to antivirus software. So while this is not the only thing protecting the devices, I thought it would assist with defense from malware that doesn't have a signature or is not able to be detected with the antivirus software. Could you elaborate on the trade-off? As I mentioned the tool Minerva, I will not be using it, but instead only building the false tools / signatures and adding them to the standard company image. Thanks!
    – Vandal
    Mar 21 '18 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.