"Security Researcher" claims they evade all AVs easily. But the sample they used for testing is not malicious, it is just calc.exe. I know the industry is not perfect, but testing malware detection with non-malicious payload is ridiculous. https://www.reddit.com/r/antiv...
If process injection happens, AVs actually check what's being injected. Process injection alone does not make something malicious. It is also done by clean software.
@bettersafetynet Security tools, debuggers, profilers, monitoring tools, diagnostic tools do process injection. You really want AV to quarantine them all?
@FuzzVector If Lolbins are used to load malware, it should be detected -- but then you'd have a malicious payload somewhere in the chain. Attacks that do not involve malware are out of scope for AV protection. They are relevant for EDR/MEDR though.
@DanielGmez3070 Since when does AV claim to protect from that?