so it's malware.
tell me, if your responsibility was to prevent, identify, and respond to breaches, what policies and technologies would you utilise to achieve this goal?
We've got one of those at work, and the most visible effect is it makes me feel like driving around with the handbrake on.
Then, every so often, it'll flag the code I'm working on as "malicious". It's pretty basic glue stuff, and launching the executable in their sandbox usually turns up nothing. Sure, I can add an exception for what I'm working on and my tools so it doesn't scan rustc every time it runs. But exceptions can only be paths. Aren't we lucky that bad guys would never ever overwrite the files I've excluded.
When we first started deploying it, I wrote a quick and dirty cryptolocker. Reading files and rewriting their content encrypted in AES. Didn't take any evasive action, just traverse directories and fetch all the files. I even went out of my way to do it multi-threaded, so I wouldn't have to wait too long while testing. Sure enough, it flagged my test-crypto.exe as suspicious. But I guess I'm not enough of threat, since I've tried renaming it to meh.exe and, wouldn't you know it, I could happily encrypt my own home folder without any bother.
So I'm still not fully convinced these aren't just like the antivirus of old, only with a different name.
I can certainly see the value in that.
But does that work when the threat is actually "new"? Say, some badstuff.exe managed to run and do its thing without being flagged by the EDR. Somehow you found out about it, say on another box. Can you investigate a posteriori how it got on the initial box and what it did there?
Oh wait! It keeps happening!
- if something requires windows, then we don't need that something.
- be in a priviledged position on the system
- open up all kind of files for analysis without the user's interaction
Now if you want a way to create a juicy target for malware authors and increase the attack surface of your system, this is one way to do it.
Threats are not simply viruses, and network detection / response is objectively different.
You also probably connect your "standalone system" to a network.
"Thankfully" it seems they did a progressive rollout of whatever version of Defender that detects our software so we didn't get every customer angry at once, which would come pretty close to a business ending event.
So yeah malware seems an adequate word to me. Especially since there's no way to find out what heuristic we're tripping and no one to ask for help so there's no guarantee that this won't happen again in a few weeks.