summiting-the-pyramid icon indicating copy to clipboard operation
summiting-the-pyramid copied to clipboard

Published 20 hours ago • verified publisher icon center-for-threat-informed-defense

Antivirus as Data Source

Open dobin opened this issue 9 months ago • 2 comments

I try to apply this in relation with my project Avred (related to Antivirus signatures), and it got me thinking.

If an AV has a signature of a tool, it will be Level 2. But is it A, U, or K?

The AV itself will be an userspace application, but its usually protected by the OS, and acting upon OS file write events, so it's "secure" like K. Same if an AV or EDR is doing disk- or in-memory scanning with yara rules, what exactly is the data source? What if executed on-demand for hunting? What if the yara scanner is downloaded and executed manually and interactive by the user?

dobin avatar Sep 28 '23 18:09 dobin