AV-TEST - Fending off Ransomware even Against State-of-the-art Attack Techniques

[harlan4096]

Fending off Ransomware even Against State-of-the-art Attack Techniques

APT groups that attack with ransomware use many different attack tactics to achieve their objectives. AV-TEST staged attacks on security products for consumer users and corporate users in 10 currently used scenarios each deploying the techniques ".Net Reflective Assembly loading”, ".Net Dynamic P/Invoke" and "AMSI Bypass". The Advanced Threat Protection tests were quite exciting as some of the programs were not able to withstand all the attack techniques.

The Advanced Threat Protection tests are indeed quite special, but they continuously test security software using the latest attack techniques of the APT groups. Such as ".Net Reflective Assembly loading", a technique used in a basic form in attacks from Cobalt Strike, Cuba or Lazarus. The techniques ".Net Dynamic P/Invoke" and "AMSI Bypass" are also popular, however, in latest attacks with ransomware. Following a successful attack, the systems are encrypted, and the blackmail by the APT groups ensues. Unless of course: the security products for consumer users and corporate users detect the attack techniques being used, stop the attack and liquidate the ransomware.

Who passes the Advanced Threat Protection test?

Each product examined in the Advanced Threat Protection test receives a special security certificate in case of strong performance. To do so, a solution is required to achieve a final security score at the end of the test that corresponds to at least 75% of the maximum 30 points – this adds up to 22.5 points.

Consumer user products then receive the "Advanced Certified" certificate, and corporate user products receive the "Advanced Approved Endpoint Protection" certificate.

In order to find a more detailed explanation of the evaluation tables and the individual color codes in the traffic light system please see also the article ”Test and Study: Do Security Solutions stop Current Ransomware under Windows 11?“.

It is worth noting: even if the Advanced Threat Protection tests occur regularly, the attack techniques used in the test are always different!
...

Full Report