AV-Test.org - Advanced Endpoint Protection: Fileless Threats Protection test - Sept19

[harlan4096]

The test is commissioned by Kaspersky and performed by AV-TESTGmbH. Date of the report: September27th2019All rights to the test results and the report belong to Kaspersky.

Executive Summary

In May 2019 AV-TEST performed a test of Fileless Threats Protection by different endpoint security products.In total 33 different fileless attacks, divided into four categories have been used to test 14products. The test aimed to reveal ability of the products to detect fileless threats (so to measure Detection Rate) and ability to Protect and Remediate all malicious actions by fileless threats (Protection Rate).

The test cases were created in-house by using well known frameworks and publicly well documented attacking techniques with intention to cover as much fileless techniques as possible.The used techniques included malware execution from WMI storage and via the Task Scheduler as well as Powershell and other scripts. Additionally, a false positive test was carried out. All tests were performed on Windows 10, with Microsoft Office installed.

During the test, the products were expected to detect the different attacks and prevent or remediate the malicious actions.The best Detection results were achieved by Kaspersky with a 100% detection rate while the average detection of all products was at 67.75%. The best Protection Rate of 94.12% was achieved again by Kaspersky while the average protection level of all products turned out 59.10%. 11 out of 14 products finished with zero False Positives in both Detection and Protection parts. For more detailed information refer to section ‘Test Results’ of the report.

The test results show that nowadays not all vendors are able to detect fileless threats and protect endpoint systems. Keeping in mind the proliferation of fileless techniques utilization from only targeted attacks to attacks onto regular users, we consider important for security vendors to improve their technologies significantly, no matter what they promise by their marketing.

No product results were excluded from the report to keep the security picture complete.   

Full PDF Report