Automated Static Analysis vs. Dynamic Analysis - Better Together?
Cybercrime has been called "the greatest threat to every company in the world," and for good reason.
In 2018, 137.5 million new malware samples were created, and 93 percent of those observed were polymorphic, meaning they had the ability to change their code to avoid detection.
Not long ago, many security experts thought they found the secret weapon to detect and eliminate these increasingly sophisticated security threats: Dynamic File Analysis.
By using Dynamic File Analysis to detonate suspicious files in secure sandbox environments, you could analyze their behavior and discover hidden malware; even if a file doesn't contain any known signatures that would indicate the presence of malware, its behavior post-execution would give it away.
And it was a big step forward — but only to a certain extent.
When the Bad Guys Got Smarter, the Malware Got Smarter Too
Dynamic File Analysis is undoubtedly a vital tool for cyber defense, but its utility is decreasing as malware attacks continue to increase in sophistication.
When cybercriminals began to realize their malware was failing due to Dynamic File Analysis, they altered the malware so it would be self-aware of the sandbox environment. For example, if the malware detected a lack of applications or files, it determined it was in a sandbox and did not fire.
Other sandbox evasion techniques include:
- Delayed Malware Execution: Because Dynamic File Analysis within the sandbox environment is time-consuming and security teams can't sit and watch the file for hours on end, hackers program their malware to delay the execution of attacks for a certain period of time or until after a system reboot.
- Password-Protected Attachments: Automated sandbox environments can't open password-protected files for analysis. By hiding malicious code in these attachments, hackers can bypass threat detection.
- Encrypted Traffic: Most organizations don't decrypt incoming traffic. When hackers hide malicious files in encrypted traffic, they can easily bypass the automated detection in sandbox environments.
So how can you combat these advances to better detect and fill the defensive gaps left by existing security tools?
