Now that we have a good understanding of how antivirus and EDR
solutions work, let's take a closer look at the type of detections
which we may encounter when operating on the system running one of
these security solutions.
First we have signatures.
A signature is usually a sequence of bytes in a file or in memory,
which is known to be malicious.
Hashes are also used extensively by antivirus.
When a file is being written to disk,
a hash of the file is calculated using a hashing algorithm.
This hash can then be compared with known malicious file hashes.
Heuristic detections attempt to identify malicious activity by analyzing a
process's behavior. As you saw previously, there are multiple techniques
which antivirus and EDR can leverage in order to identify what a process is
doing at runtime. Machine learning and artificial intelligence can also be
used to automate tasks performed by a malware analyst when leveraging
static analysis techniques on a file to classify it as either benign or
malicious.
Usually, when analyzing a malicious document,
an analyst will look at various characteristics of a file,
which may reinforce his belief that the file may indeed be malicious.
Finally, we have threat intelligence feeds.
These feeds can be consumed and correlated with the data
collected by the various antivirus components.
For example, IP addresses, registry keys,
file names, and domain names may be known to be malicious and might
cause a detection by the anti virus or EDR solution.