Thread Info
  • Replies 7 replies
  • Subscribers 6 subscribers
  • Views 15207 views
  • Users 0 members are here
Options
Suggested

How to test the new Intercept X features?

Vincent Vanbiervliet

Update: 4/3/2020 - This test tool is no longer available. More info to come.

 

EFS Guard

Dummy (Unsigned) ⇒ Ransomware ⇒ EFS

Note: it is important to choose the unsigned version of "Dummy", as the signed version is allowed to encrypt files.

Dynamic Shellcode Protection

Dummy ⇒ Code exploits ⇒ Dynamic Shellcode (HeapHeapProtection)

CTF Guard

Dummy ⇒ Process protection ⇒ CTF Service exploit

ApiSetGuard

Dummy ⇒ Code exploits ⇒ LoadLib APISet

Parents Reply Children
  • in reply to pfeffex

    Yes, I'm running Intercept X Advanced with EDR.  The download provides me with a .exe so there's no ZIP to extract.  Of course you could create an exclusion for this ML/PE-A detection and it should still detect any exploit detections that you trigger with the tool but I'm wondering if this detection is expected.  With the tool being unsigned and performing similar exploits it's not too surprising that it has a low malware score.  I get lockdown detections when attempting to use the unsigned tool and only when I disable all exploit features do I get an ML/PE-A detection.

  • in reply to MEric

    Sorry it was a .exe, yes of course. It's bad that I connot upload a picture here. Anyhow, it was detected as ML\PE-A Root Cause Firefox. Firefox downloaded sophostester.exe. Sophostester_unsigned.exe triggered the event. It's only an information for the vendor. For me as a customer it's a little bit confusing that a vendor owned program is detected and there is no global exclusion for this tool as default. Cheers!

Unfiltered HTML