Latest News
September 27, 2019 | Commissioned tests
Advanced Endpoint Protection: Fileless Threats Protection test
In May 2019 AV-TEST performed a test of Fileless Threats Protection by different endpoint security products. In total 33 different fileless attacks, divided into four categories have been used to test 14 products. The test aimed to reveal ability of the products to detect fileless threats (so to measure Detection Rate) and ability to Protect and Remediate all malicious actions by fileless threats (Protection Rate).
A test commissioned by Kaspersky
and performed by AV-TEST GmbH
The test cases were created in-house by using well known frameworks and publicly well documented attacking techniques with intention to cover as much fileless techniques as possible. The used techniques included malware execution from WMI storage and via the Task Scheduler as well as Powershell and other scripts. Additionally, a false positive test was carried out. All tests were performed on Windows 10, with Microsoft Office installed.
During the test, the products were expected to detect the different attacks and prevent or remediate the malicious actions. The best Detection results were achieved by Kaspersky with a 100% detection rate while the average detection of all products was at 67.75%. The best Protection Rate of 94.12% was achieved again by Kaspersky while the average protection level of all products turned out 59.10%. 11 out of 14 products finished with zero False Positives in both Detection and Protection parts. For more detailed information refer to section ‘Test Results’ of the report.
The test results show that nowadays not all vendors are able to detect fileless threats and protect endpoint systems. Keeping in mind the proliferation of fileless techniques utilization from only targeted attacks to attacks onto regular users, we consider important for security vendors to improve their technologies significantly, no matter what they promise by their marketing.