TM, poor detection rate

@kotilainenseppo​ 

Thank you for your answer!

Just go to "Malwarebazaar"  (hxxps://bazaar.abuse.ch/) and pick any sample from top to bottom.

95% of the are detected by Windows Defender in VT

10% are detected by TM in VT

Even more, I downloaded and executed them on a test PC (not virtual machine); the detection rate of TM replicates that found on VT

"But where TM shines, it is BB/AI of it"

That could be, but the FP are very high (42 FP, highest rate on AV Comparatives)

Thanks!

@claudiubotezatu 

Hello, i'm using TM in "hypersensitive" mode. I've been testing various security solutions and combos a lot against various bazaar samples, executables, fileless(LOLBins) etc. There was quite a lot malware samples that TM did not detect by it's signatures(VT results), but on my testing all of them were blocked by it's BB(aka AEGIS/AI) "Suspicious File Blocked". In VT, you only see its detections by signature only, not "Suspicious File Blocked" detections.

I'm not sure if "hypersensivite" mode also affects to script based malwares. When i tested it against some script based malwares, it does allow some scripts to download(by using bitsadmin) droppers to the host machine, but those droppers were blocked because TM finds them suspicious, so malware cannot run. 

I'm running TM with Voodooshield Cyberlock Pro and found this combo really, really effective against any kind of malwares.

And yes, 42 false positives is quite high, but personally i haven't come across any false positives(yet). 

I'm not sure if TM these protects these critical registry keys, if not, they should be added. 

You can do this with simple script(bat,vbs,js etc) then call force shutdown and your computer is basically unusable.

@tm_kath​ 

Thank you!

This was detected 2 days after my post , but it was used just as example.

Each an every day there are hundreds detected by Windows Defender and some other major players but not TM

See another example, as we speak:

https://www.virustotal.com/gui/file/8f8469ba4407f303bb18eb6e17b2360df9ebb53c2fc41b921ea2946469eed29d?nocache=1

Above sample is blocked by TM "Suspicious File Blocked". But no signature detection yet. 

@claudiubotezatu @kotilainenseppo 

Update on this one https://www.virustotal.com/gui/file/8f8469ba4407f303bb18eb6e17b2360df9ebb53c2fc41b921ea2946469eed29d?nocache=1  detected as Trojan.Win32.PRIVATELOADER.YXDADZ

AVs have different processes and technologies in detection. For  Trend Micro Security, a series of layered protection will scan the monitored file or process before detection is reached, Is it safe or not, and what action does Trend Micro Security need to execute based on the detection?

Appreciate your insights!

More insights on How Trend Micro Security fares with competitors:

Test Trend Micro Internet Security 17.7 for Windows 10 (221520) | AV-TEST

Test antivirus software for Windows 10 - October 2022 | AV-TEST

Hello tm_kree,

In AV test , from 20 antiviruses tested 18 have 100% detection. While I un derstand that "AVs have different processes and technologies in detection"  I am surprised that Windows Defender is always capable to create a signature fast for whatever is posted on Malware Bazaar while TM is lagging behind with 3-5 days, relying on "different" mechanisms.

Thanks.