Transcription
As you can tell, we have new toys to test today. It's another one of these next-gen AVs; this time, it's CrowdStrike Falcon.
Quite popular in some enterprises, and you can tell from the website it's very business-centric. It doesn't even get to talking about malware or AVs until like the fourth page or something. There we go, Falcon Prevent next-gen AV, but the focus is very much on stuff like increasing security, efficiency, productivity. So thumbs up to the marketing team. I mean, this is exactly what businesses will be looking for, but we're not interested in that, are we? We're here to test it against the blood-thirstiest, shoot-'em-first, year-stall-gone-worst, deist malware we can find. And for that, I need to have it installed on the VM.
Like most of these products, it's hard to obtain at all. But it's actually funny since my Silence video has been getting a lot of email from enterprise customers who are like, "Hey, we'd love to set up an account for you at our company so you can test this product out so we know how it does." I'm not surprised, to be honest. They're essentially getting penetration testing services for nothing. So haha, a business idea, and I get a no-effort, hands-on experience—win-win.
Anyway, first I'll need to talk about how this product is set up, just so you understand. Remember how I was complaining about Silence not having a full GUI on the desktop? Well, this one has no GUI on the desktop. In fact, it's hard to even tell that you have it running. I'm not necessarily saying that that's a problem, but it's just an inconvenience to someone like me. The only way to really tell that CrowdStrike is actually active, other than the fact that I installed it using this executable here, is to go into services and look for the agent. So we do have CrowdStrike Falcon Sensor Agent running.
Fortunately, this time I managed to get myself an account with this company so I can actually use the dashboard. As you can see, we've got ten new detections. This was when I was testing it previously; I've restored to a different snapshot now. Something to note from that experience is this product has two modes, like a lot of these new next-gen AVs: one is learning mode and one is a blocking mode. Now, last time it was actually active in learning mode, and it just let a bunch of ransomware straight through. I'm not sure how it's going to do now with the blocking mode on, but I just wanted to let you know, in case you're running this on any production systems, make sure you're not running it in learning mode. That would be a really bad idea.
So now that I've got that out of the way, I think we can move straight to the test. So, as usual, we're going to be using our little Malloc script, a Python-based tool that's going to automate running our classified malware. I've got some brand new malware over here, and if we take a look at this folder, 13:51 again, close to 1500—that's what I'm aiming for these days. I'm sure there's a lot of PUPs in here, probably some ransomware as well, and I have no idea how Falcon is going to deal with it. So let's find out. Malloc's just terminated randomly. Let's go back to the online dashboard and see what's happening. So we do have new detections, and it seems that terminated Malloc, unless it was done by the malware. So we have a lot of high, critical, and medium-level alerts, and you can see the hierarchy of execution here. So we've got PowerShell running Python, and Python launching email where the—hey, our system is already unresponsive. No idea what's going on. Hmm, I was thinking I'd probably have to redo the test at this point after contacting the admin, but we might not have to do that if the system's destroyed already. You know what, let's just reset and see if the system comes back online just fine. All right, seems their stuff's still executing. We've got a service running over here. You know what, let's let's try and rerun the test and see what happens. What, what? So PowerShell is gone. Wait, are you serious? You've got a notification. So that was from malware clearly. Hmm, you know what, let's get some current Genovese and see what they have to say. You've hosts.exe and C:\Windows\… What? HitmanPro finally finished scanning, and you know it's bad when I can't even show you the results. I really can't, not on YouTube at least, because there's so many inappropriate names down there. Essentially 2025 threats. I'm not sure how the product works; maybe it's not configured correctly, but why is this even possible? You know what, I really don't believe it. I'm going to try to get in touch with the company and try to ensure that this is actually set up correctly, because there's no way I'm publishing this without verifying that it was set up correctly.
Okay, so it turns out the product was actually misconfigured. It's one day since—past Leo had to go through that traumatic experience—and we're ready to get testing again. But it's important to note how these products work; they have a lot of sensitivity settings. I'm not sure exactly what went wrong, but at the moment we have it set to moderate to aggressive. I think it's important to note, though, that despite the admin trying to configure it twice to make sure that was set up correctly for the test, the fact that we could have such a situation suggests that it's highly possible that there are other organizations or enterprises that are running this do not have it configured correctly. So if you're running this, make sure you go into those settings; they're quite complicated, so do check them periodically and make sure your systems are actually protected, because otherwise you could end up with the system like I did. Well, you saw what it was; it was not pretty.
Anyway, now we're finally ready for the test. I do have to grab some new malware because this is one day later. I've got 1478 items again, collected a few hours ago, so everything should be good. And here we go. And immediately we get a notification from CrowdStrike Falcon Sensor saying that a malicious process was blocked. I have to say, I really like the name of this product—Falcon—bird-of-prey. I've always been a fan of the F-16. Future cybersecurity startups, take notice. Something else I'm already noticing is that this is a lot slower than Silence. We are only at 3% performance-wise; we're not doing too bad, to be fair. CrowdStrike Falcon's only at like 7 or 8 percent. [Music]
Finally, the test is done. We have all 1477 files executed. Proactive detection is sitting at 98.58%. That's quite good, as far as numbers go, but let's see what's running on the system. So we have this setup process; it's not doing anything, as far as I'm concerned. Let me try to close it. Can't? It's one of those broken, annoying PUPs. No, no, it's just that the system was slow. It's kind of weird; the system feels a lot slower than it did in my previous Silence test, for some reason. I mean, it slowed down in the Silence test, but that was just because of malware. I don't see any active malware processes; of course, there's only so much my eyes can see, so I'm going to restart the system, get rid of this folder, and then we'll do the second opinion scans. All—no, I have to update again. Hide Term Management Theory 101. Now this is the really annoying thing about testing in Windows 10; it is just not convenient as a malware list. It makes you want to—it is really annoying. Okay, Windows is taking its sweet time to boot, and we're finally in. CrowdStrike is still detecting some malware. We do have quite a few detections registered; surprisingly, not as many as the number of files we executed. Maybe some of those are stacked up, but we do have the risk levels being identified—some as low, some as medium. I'm guessing the PUPs are low. To go into quarantine files, there's all this stuff, and if we look into the folder, there's only 139 left. So it seems CrowdStrike deleted a lot of it. Now I'll delete the rest, run CCleaner. This is the usual second opinion scan ritual. Go into SOS, because that is what we need. We'll start with HitmanPro. System still slow, though, or malware playing peek-a-boo. You can never tell, though, can you? Okay, with Norton Power Eraser as well. Two scans side-by-side is as far as I'm willing to take with the system. If we can manage that networking issue, great. What is happening here again? This time I actually thought the system was clean, but no, it's got active malware again. LocalNetService.exe—this is malware—and its present in ProgramData. Another malware in ProgramData with a name that you can only read if you drink like six bottles of vodka every day. Okay, we've got another name which you can only read if you drink six bottles of vodka every day, but for a completely different reason. It says this one's suspicious, but given that it's active, and given that this is the name and this is the folder, I'm quite sure that this is not a benign file. Also, funnily enough, it seems our internet has been tampered with—at least a DNS server. Norton Power Eraser cannot connect, but I can tell you we do have internet. There you go, so it's not like my ISP screwed up or anything. I'm still connected, by the way. When we were running the test, there were a lot of IP loggers popping up; some of you pointed that out in my previous video of Silence. And yes, rest assured, I am behind a VPN, but yeah, that doesn't particularly bode well for the enterprise using the product, I guess. It seems we just can't get Norton to run because of the internet issue. I'll try running Malwarebytes. We'll start the scan and hold as the scanning. I'm going to do a similar false positive test like I did last time. The system is really slow, by the way, right now. It's hard to even move an explorer window. Go into tossed folder… JGEI engine. You can guess what it does from the name; it's a really old program for encrypted communication. It's completely safe, but a lot of the new AI engines will pick it up anyway because they think it's ransomware, even though it's not. And so does CrowdStrike Falcon. Not surprised. And this is where I think a lot of you have to realize that there's no magic trick; it's always going to be a balance, and if you push too hard on one side, you're going to upset the other, and there's not necessarily any benefit to running your security product in high settings. I have a lot of people who comment saying, "Why don't you just max out the settings on every product that you test? Why do you test about default settings?" One of the basics of security is that security and availability are like on two opposite sides of the spectrum, and they're both very important. If anything, availability is more important. I mean, that's what ransomware does, right? The reason it's so deadly is because it doesn't simply access files that it shouldn't; it then takes them away from you. So I always recommend running balanced settings on your product to where it's functional, and that's usually where the security is going to be best as well. Now, funnily enough, Malwarebytes seems to be finding a ton of stuff. So we've got a lot of out-where registry keys, Wi-Fi Surface ID.exe. Cool glitch that just shows you how slow the system is right now. Trojan process—interesting; this wasn't even picked up by HitmanPro. So more nasty stuff than I anticipated. Damn, I was really hoping that this would be a good result. I really liked the name; you ruined my favorite bird. Well, now I like Eagle better. This is not a good result. I mean, look at this; there's tons of Trojans, and I think we've got the culprit for the internet issue: Trojan DNS changer, Trojan.Agent, more DNS changer, trick bots, Trojan trick bot. So if you wanted to see it in an AV test video, there you go. And then we have an optional PUP optimizer. So I'm just going to point out that this is not a test in isolation; that's not the only test I'm doing like this. I have done tons and tons of videos of all sorts of AV products tested with the exact same method. Usually the standard for me for a good result for any AV product, next-gen or not, is a clean sheet or something close to a clean sheet, and that means not having a ton of infections, not having active malware on the system. A couple of PUPs—that's fine—that—as you can tell, this is far from that. And also keep in mind that this is already set to aggressive; you're already getting a fair bit of false positives as it is, and it seems you're still—and look at that, we just got ransomware detection there. It's trying to load some website in the background. So, I mean, all things considered, as much as I like the name and as complicated and fancy as their dashboard looks, at the end of the day, the only thing you should care about with a security product is the protection, and to me, it just doesn't look great, considering the price and the setup of something like this. I think you can do better; you should do better. So I'd highly recommend checking out the other reviews on TPS; there are dozens and dozens of those that should give you some context about what these results mean and why I'm saying what I'm saying. Don't forget to like and share the video if you enjoyed it. Thank you so much for watching, and as always, stay informed, stay secure. [Music]