Legitimate and trusted software and built-in components in Windows are often used by cybercriminals to hide malicious activity. The so-called “Living off the Land Binaries” (LOLBin) are necessary for the proper functioning of the operating system. During a cyberattack, it can be difficult or impossible to block them, making them a very attractive method for malware developers. Below we present the most commonly used LOLBin in this edition of the test.
The following summary shows a comparison of tested solutions to protect workstations against malware. We encourage you to become familiar with a detailed description and read our testing methodology in order to understand the results.
PRE-LAUNCH: The classification concerns detecting malware samples before they are launched in the system.
POST-LAUNCH: The analysis level, i.e. a virus has been run and blocked by a tested product.
FAIL: The failure, i.e. a virus hasn’t been blocked and it has infected a system.
Sandbox Column: Number of indicators, i.e. malicious changes made to the system without the anti-virus installed.
Automatic Average Remediation Time (RT): The time expressed in seconds counted from the introduction of malware into the system by the browser, through the launch to the detecting and resolving a security incident.
Certificates are granted to solutions that are characterized by a high level of security, with a rating of at least 99% of blocked threats in the Advanced In-The-Wild Malware Test.
Our tests comply with the guidelines of the Anti-Malware Testing Standards Organization.
Details about the test are available at this website as well as in our methodology.
Blocked: 510/510
Total: 100%
RT: 8.7 seconds
Blocked: 510/510
Total: 100%
RT: 112.3 seconds
Blocked: 510/510
Total: 100%
RT: 17 seconds
Blocked: 510/510
Total: 100%
RT: 1.7 second
Blocked: 510/510
Total: 100%
RT: 6.1 second
Blocked: 510/510
Total: 100%
RT: 1.56 second
Blocked: 510/510
Total: 100%
RT: 16 seconds
Blocked: 507/510
Total: 99.41%
FAIL: 3
RT: 26.6 seconds
Blocked: 510/510
Total: 100%
RT: 13.6 seconds
Blocked: 510/510
Total: 100%
RT: 74.9 seconds
Blocked: 510/510
Total: 100%
RT: 19.8 seconds
Dive into our latest publication, dedicated to security test against malware. Uncover analyses, methodology, and results that provide invaluable insights into the latest edition of the Advanced In-The-Wild Malware Test.
You can always go back in time and check how each individual security product performed during previous editions of the test. We make the results from all previous tests available to you to verify if your favorite developer has improved protection against latest malware in his security software.
Vendors can participate directly in the Advanced In-The-Wild Malware Test or obtain a Certification-Only Package for a product independently tested by AVLab. Paid participation provides access to extended technical services, test data, and custom configuration options, while result review and verification remain available to all tested vendors.
Commercial use of AVLab certificates, certification badges, and award materials by independently tested vendors requires either Paid Assessment Participation or a Certification-Only Package. Independently tested vendors without either option may be listed in AVLab results and certification records but are not granted the right to use AVLab certification materials in their own marketing or communications.
