
Antivirus Bypass Techniques
By :

In this section, we will discuss how to strengthen the detection of antivirus software in order to make the antivirus software more reliable using the dynamic YARA concept, the detection of process injection attempts, and more.
As mentioned in Chapter 5, Bypassing the Static Engine, YARA is an easy-to-use, straightforward, yet effective tool to hunt for malicious patterns in files. It can not only be used on files but also to hunt for malicious strings, functions, and opcodes at the memory level. The yarascan
volatility plugin makes practical use of "dynamic" YARA to scan for potentially malicious strings and code at the memory level, or in practical terms, on a dumped memory snapshot.
We believe that all antivirus vendors should implement this strategy (if they have not already) as part of their detection engines.
The dynamic YARA strategy gives your antivirus detection engine the ability...
Change the font size
Change margin width
Change background colour