Detection Methods
Antivirus signature syntax and scope may differ based on the engine
they have been built for, but they still serve the same purpose
of uniquely identifying a specific threat or malware.
In this section, we are going to explore multiple AV detection methodologies
and explain how they work together.
Signature-based antivirus detection
is mostly considered a restricted list technology.
In other words, the filesystem is scanned for known malware signatures
and if any are detected, the offending files are quarantined.
A signature can be just as simple as the hash of the file itself
or a set of multiple patterns,
such as specific binary values and strings
that should belong only to that specific malware.
Relying on just the file hash as the only detection means is a weak strategy
because changing a single bit from the file
would result in a completely different hash.
As an example, we created a text file on our local Kali machine
that contains the string “offsec”.
Let’s dump its binary representation via the xxd tool
by passing the -b argument before the file name.
We displayed the content of the file through the xxd utility,
which shows the binary offset on the leftmost column,
the actual binary representation in the middle column,
and the ASCII translation on the rightmost one.
Now, assuming this is real malware, we want to calculate the hash of the file
and we can do so through the sha256sum utility.
Let’s now check the binary value of a file containing “offsec” but with a capital C.
We notice that the binary value of the last letter
is changed only in its third bit from the left.
Since every hashing algorithm is supposed to produce a totally different hash
even if only one bit has changed,
let’s calculate the SHA256 hash on the modified string.
Unsurprisingly, the hash value has fully changed,
which proves the fragility of relying solely on hash file signature detections.
To address the pitfalls of signature-based
antivirus manufacturers introduced additional detection methods
to improve the effectiveness of their products.
Heuristic-Based Detection is a detection method that relies on various rules and
algorithms to determine whether or not an action is considered malicious.
Alternatively, Behavior-Based Detection
dynamically analyzes the behavior of a binary file.
Lastly, Machine-Learning Detection aims to up the game by introducing ML algorithms
to detect unknown threats by collecting and analyzing additional metadata.
Since these techniques do not require malware signatures,
they can be used to identify unknown malware,
or variations of known malware, more effectively.
Given that antivirus manufacturers use different implementations when it comes to
heuristics, behavior, and machine learning detection,
each antivirus product will differ in terms of what code is considered malicious
It’s worth noting that the majority of antivirus developers use a combination of
these detection methods to achieve higher detection rates.
In order to demonstrate the effectiveness of various antivirus products,
we will start by scanning a popular Metasploit payload.
Using msfvenom, we’ll generate a standard Portable Executable file
containing our payload, which, in this case, is a simple TCP reverse shell.
Let’s generate the test binary payload by running the msfvenom command
followed by the -p argument specifying the payload.
We’ll then pass the reverse shell local host
and local port arguments along with the file format,
and redirect the output to a file.
Next, we’ll run a virus scan on this executable.
Rather than installing a large number of antivirus applications
on our local machine
we can upload our file to VirusTotal,
which will scan it to determine the detection rate of various AV products.
We’ll notice in our results that many antivirus products
determined our file is malicious
based on the different detection mechanism we have illustrated in this section.
In this Learning Unit,
we have explored the different components that constitute a modern AV
and covered the various strategies adopted to detect malicious software.