Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I am using MS Defender for Mac to specify a list of unwanted applications on the managed devices in my company. I am concerned that some users try to evade the detection by altering the binaries of the files.
Let's pick a (dumb) example: Assume, the Brave browser is classified as an unwanted application. How could or would a user be able to alter the binary to evade detection?
Re-combining binaries to be in different but functionally equivalent forms which evade anti-virus is a fairly trivial problem. There is a class of tools "obsfucation tools" to automate this process which can either re-arrange portions of the binary or encrypt their contents. Can your average end user do it? No. But it would be trivial for a determined attacker.
Some AV products have some protection against this (by predicting and/or noticing the output from the most common tools), but it's not reasonable or feasible for any such mechanism to detect all potential obsfucations. Plus the more you detect, the more false positives you will get.
In designing a security policy, making a whitelist would probably be easier than a blacklist. Likewise, other permissions and security settings should be set outside of simply installing a managed anti-virus. For example, making sure users do not have permission to run common software installers or add entries to the system startup.
