My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats. Software carries with it it's own digital signature. If this signature for a particular item matches a known signature in the database it is flagged as malicious and the necessary action is taken.
- Do AV's rely solely on this method?
- Say for example, malware gets past the AV (because it's signature is new), is the malware home and dry?
- Or does such things like behavioural analysis still prevail? Say the malware executes known commands or uses known components; Metasploit framework, Empire etc the malware has already gotten past the AV in terms of signature based detection, providing the malware is clean, are the odds other defences potentially in place may pick up malicious activity?
- For how long does AV 'hang on' to a particular executable? Say it begins scanning it the moment it drops to disk. Okay so it's clean (according to AV), will it sign off on the executable, lower it's vigilance, increase, whitelist or ignore?
2) Are binary executables dead in terms of initiating malicious payloads? - I see a lot of articles regarding known threats, particularly in the past, whereby the malicious payload was not simply downloaded in executable format and then executed. A payload may for example be hidden in a PDF, Word document and even then, the payload is yet to be executed and is simply downloaded using a Powershell command - At what point then are good 'ole fashioned binary executable payloads in .exe format useful in a potential attack, if at all? It's obvious to me many .exe payloads are dissected and ripped apart by AV vendors today, and rightfully so. It is by far, from what I have learned, the most common attack vector (if that is the right way to explain it?) and also the oldest and well worn. A person downloads an exe he thinks is legit, it's not, it sets up a reverse shell, you're done. Or, a person downloads a file, thinks it's legit, it's a keylogger, you're done, or a RAT.
I keep getting the feeling there is more behind the scenes. The more I've messed around with exploiting a Windows based system (in my own lab environment) the more difficult and sometimes messy it can be just to simply get the thing onto the computer in the first place. I've used hex editors, UPX, added useless dlls and resources to confuse detection scans, false signed executables, changed exe templates and yet... it feels like something is missing. Appreciate feedback on this! Thanks!