WEBVTT

00:00:00.640 --> 00:00:04.019
Now that we have a good understanding of how antivirus and EDR

00:00:04.019 --> 00:00:07.960
solutions work, let's take a closer look at the type of detections

00:00:07.970 --> 00:00:11.410
which we may encounter when operating on the system running one of

00:00:11.410 --> 00:00:13.010
these security solutions.

00:00:13.150 --> 00:00:14.560
First we have signatures.

00:00:15.240 --> 00:00:19.660
A signature is usually a sequence of bytes in a file or in memory,

00:00:19.670 --> 00:00:21.400
which is known to be malicious.

00:00:21.600 --> 00:00:25.160
Hashes are also used extensively by antivirus.

00:00:25.540 --> 00:00:27.490
When a file is being written to disk,

00:00:27.500 --> 00:00:31.360
a hash of the file is calculated using a hashing algorithm.

00:00:31.740 --> 00:00:35.670
This hash can then be compared with known malicious file hashes.

00:00:35.850 --> 00:00:40.770
Heuristic detections attempt to identify malicious activity by analyzing a

00:00:40.770 --> 00:00:45.110
process's behavior. As you saw previously, there are multiple techniques

00:00:45.120 --> 00:00:49.810
which antivirus and EDR can leverage in order to identify what a process is

00:00:49.810 --> 00:00:54.430
doing at runtime. Machine learning and artificial intelligence can also be

00:00:54.430 --> 00:00:58.540
used to automate tasks performed by a malware analyst when leveraging

00:00:58.540 --> 00:01:02.970
static analysis techniques on a file to classify it as either benign or

00:01:02.970 --> 00:01:03.650
malicious.

00:01:03.940 --> 00:01:06.450
Usually, when analyzing a malicious document,

00:01:06.460 --> 00:01:09.810
an analyst will look at various characteristics of a file,

00:01:09.820 --> 00:01:13.960
which may reinforce his belief that the file may indeed be malicious.

00:01:14.340 --> 00:01:16.540
Finally, we have threat intelligence feeds.

00:01:16.860 --> 00:01:19.700
These feeds can be consumed and correlated with the data

00:01:19.700 --> 00:01:22.420
collected by the various antivirus components.

00:01:22.430 --> 00:01:25.600
For example, IP addresses, registry keys,

00:01:25.610 --> 00:01:29.720
file names, and domain names may be known to be malicious and might

00:01:29.720 --> 00:01:33.560
cause a detection by the anti virus or EDR solution.