BREACH RESPONSE TEST:
Kaspersky Anti Targeted
Attack Platform

www.SELabs.uk

info@SELabs.uk@SELabsUK

www.facebook.com/selabsukblog.selabs.uk

SE Labs tested Kaspersky Anti Targeted Attack Platform against a range of hacking attacks
designed to compromise systems and penetrate target networks in the same way as criminals
and other attackers breach systems and networks.
Full chains of attack were used, meaning that testers behaved as real attackers, probing targets
using a variety of tools, techniques and vectors before attempting to gain lower-level and more
powerful access. Finally, the testers/ attackers attempted to complete their missions, which might
include stealing information, damaging systems and connecting to other systems on the network.
2

Breach Response Test: Kaspersky Anti Targeted Attack Platform

CONTENTS
MANAGEMENT
Chief Executive Officer Simon Edwards
Chief Operations Officer Marc Briggs
Chief Human Resources Officer Magdalena Jurenko
Chief Technical Officer Stefan Dumitrascu

Executive Summary

05

1. Total Accuracy Ratings

06Enterprise Endpoint Protection Award

06

2. Threat Types

07

3. Threat Details

08

4. Threat Responses

09

5. Protection Ratings

11

IT SUPPORT

6. Protection Scores

12

Danny King-Smith
Chris Short

7. Protection Details

13

PUBLICATION

8. Legitimate Software Ratings

14

Steve Haines
Colin Mackleworth

8.1 Interaction Ratings

15

8.2 Prevalence Ratings

16

8.3 Accuracy Ratings

16

8.4 Distribution of Impact Categories

17

9. Conclusions

17

Appendix A: Terms Used

18

Appendix B: FAQs

18

Appendix C: Threat Types and Vectors

19

TESTING TEAM
Thomas Bean
Dimitar Dobrev
Liam Fisher
Gia Gorbold
Pooja Jain
Jon Thompson
Dave Togneri
Jake Warren
Stephen Withey

Website www.SELabs.uk
Twitter @SELabsUK
Email info@SELabs.uk
Facebook www.facebook.com/selabsuk
Blog blog.selabs.uk
Phone 0203 875 5000
Post SE Labs Ltd, 55A High Street, Wimbledon, SW19 5BA, UK
SE Labs is BS EN ISO 9001 : 2015 certified for
The Provision of IT Security Product Testing.
SE Labs is a member of the Microsoft Virus Information
Alliance (VIA); the Anti-Malware Testing Standards
Organization (AMTSO); and the Messaging, Malware
and Mobile Anti-Abuse Working Group (M3AAWG).
(c) 2019 SE Labs Ltd

3Introduction04

Breach Response Test: Kaspersky Anti Targeted Attack Platform

Document version 1.0 Written 9th September 2019

INTRODUCTION

Breach Security Testing
Testing anti-breach products needs the full chain of attack
This Breach Response Test is a new kind of test. We believe thatthat run from the initiation of an attack through to a successful

the testing behind this report used the largest range of relevant

completion of the attacker’s prime goal.

threats in any publicly available test and that the analysis of
how the products tested work is the most in-depth.

Testers should not assume that certain approaches toprotection are better than others. If a security company

4

We go into some detail on page 9 about how threats work in a

makes the world’s best behavioural detection system but

chain of stages because this is a really important and possiblya test pays attention only to URL blocking technologies thenunique feature of the Breach Response Test. It’s crucial to copy

the product will fail the test, while in reality customers who

attackers’ techniques in full when assessing security products.

use it would be protected.

A computer breach causes some kind of damage, whether that

It is common for us to see a product appear to fail, and allow

involves deleting or encrypting files on a computer system;

malware to run, even to the point where we obtain a remotestealing data that damages a company’s ability to compete; orconnection to the target. However, when we try to take control

stealing personal data for use in fraud. The possibilities andof that system we may be blocked from doing so. A tester thatcombinations are endless, but ultimately damage has tosees the connection open might wrongly conclude that thebe done. Cyber criminals don’t usually hack systems out of

product has failed. It is only by running through the entire attack

simple idle curiosity.

process that it is possible to assess a product’s full abilities.

This is an important detail frequently overlooked in security

If you spot a detail in this report that you don’t understand,testing, which often examines a product or service’s ability toor would like to discuss, please contact us via our Twitter orstop certain stages of attack, but not the full chain of events

Facebook accounts.

Breach Response Test: Kaspersky Anti Targeted Attack PlatformExecutive Summary
Kaspersky Anti Targeted Attack Platform

Kaspersky Anti Targeted Attack Platform v.2.0 (KATA) was tested against
a range of hacking attacks designed to compromise systems andwas effective against a diverse set of exploits,

penetrate target networks in the same way as criminals and otherfile-less attacks and malware attachments,

attackers breach systems and networks.

comprising the widest range of threats in any
currently available public test.
All of these attack types have been witnessed

We examined its abilities to:
Detect highly targeted attacks

in real-world attacks over the previous few years.

Protect against the actions of highly targeted attacks

They are representative of a real and present

Provide remediation to damage and other risks posed by the threats

threat to business networks the world over.

Handle legitimate applications and other objects

The threats used in this are similar or identicalto those used by the threat groups listed in
3. Threat Details on page 8.

Legitimate files were used alongside the threats to measure any false
positive detections or other sub-optimum interactions.

Sometimes what seems like a bad result is
Kaspersky Anti Targeted Attack Platform v.2.0 (KATA) detected all ofa good one.

the targeted attacks and protected the targets from 82 of the 85 attacks,

In some test cases the product, on the face ofpreventing them from effectively providing remote access, causing

it, failed to protect the system but in-depth

damage or stealing data.

testing showed that an attacker would not havebeen able to achieve any useful goals, despitewhat appeared to be a failure in protection.
Testing using the full attack chain is crucial
for accurate results.

EXECUTIVE SUMMARY

Product Tested

Protection
Accuracy (%)

Legitimate
Accuracy
Rating (%)

Total
Accuracy
Rating (%)

92%

100%

95%

Kaspersky Anti Targeted Attack Platform

Products highlighted in green were the most accurate, scoring 85 per cent or more for Total Accuracy.
Those in yellow scored less than 85 but 75 or more. Products shown in red scored less than 75 per cent.

5

Breach Response Test: Kaspersky Anti Targeted Attack Platform

There were no issues with false positives.
The product was completely accurate whenhandling legitimate objects, which shows thatits settings were not too aggressively deployed.
Kaspersky Anti Targeted Attack Platform
performed very well in this test and achieveda AAA award.

1. Total Accuracy Rating
Judging the effectiveness of an endpoint security

execute but prevent it from downloading any further

product is a subtle art, and many factors are at playcode to the target. In another case malware mightwhen assessing how well it performs. To makerun on the target for a short while before its

things easier we’ve combined all the different

behaviour is detected and its code is deleted or

results from this report into one easy-to-understand

moved to a safe ‘quarantine’ area for future

graph.

analysis. We take these outcomes into accountEnterprise Endpoint
Protection Awards
The following productwin SE Labs awards:

when attributing points that form final ratings.
The graph below takes into account not only eachproduct’s ability to detect and protect against

For example, a product that completely blocks athreats, but also its handling of non-malicious

threat is rated more highly than one that allows aobjects such as web addresses (URLs) andthreat to run for a while before eventually evicting it.

applications.

Products that allow all malware infections, orthat block popular legitimate applications, arepenalised heavily.

Not all protections, or detections for that matter,

Jan-Mar 2019are equal. A product might completely block a URL,
which stops the threat before it can even start its

Scoring a products response to a potential breachintended series of malicious events. Alternatively,

requires a granular method, which we outline in

the product might allow a web-based exploit to

4. Threat Responses on page 9.

 aspersky Anti Targeted■ K

Attack Platform
TOTAL ACCURACY RATING

Product

Total Accuracy
RatingTotal
Accuracy
Rating(%)

Award

563

95%

AAA

Kaspersky Anti Targeted Attack Platform

Kaspersky Anti Targeted Attack Platform
0

6

118

236

354

Breach Response Test: Kaspersky Anti Targeted Attack Platform

472

590

Total Accuracy
Ratings combine
protection andfalse positives.

2. Threat Types
This test includes a diverse set of exploits, file-lessThere were six main types of threat used,attacks and malware attachments, comprising theregardless of vector. These are described inwidest range of threats in any currently available

the table below.

public test. The threats were directed at Windows
7 and Windows 10 targets running a number of

For a detailed breakdown of the types of threatsdifferent web browsers, email clients and otherused with different vectors see Appendix C:

relevant applications.

Threat Types and Vectors on page 19.

Not every specific attack used in the test wascompatible with both target platforms (Windows
7/ 10), so some attacks would only work with

THREAT TYPES
Threat Type

Description

Exploit (File Format)

File format-based exploits are threats that come in the form of a file such asa PDF, Word, Excel or PowerPoint document. Their success relies on targets
opening such files in applications that are vulnerable to the malicious constructionof the document.

Exploit (File-less)File-less threats exist in memory rather than writing data to the hard disk. In
practice files are involved in a ‘file-less’ attack but they are not written to long-term
storage devices.

Injection

The ‘Injection’ attacks in this test involve injecting malicious code into otherwise
legitimate applications in an effort to disguise the threats.

Injection (Evasion)

The ‘Injection (Evasion)’ attacks in this test involve generating malicious
executable files that inject themselves straight into memory in an effort toevade detection.

Script (File-less)Threats using script-based technologies such as Powershell, Visual Basic andHTML Application can run on the system without writing their own code to
the hard disk.

Script (Evasion)

Evasive script attacks use script-based technologies delivered in ways that make itharder for some security products to detect.

Windows 7, for example, while others would work
only against Windows 10.
Many attacks were tried with both unencrypted
and encrypted connections between the target
and the attacker to identify potential weaknesses
in a product’s detection and protection systems.

Categorisations
The threats used in this test can be categorised ina number of ways including by vector and by thetype of the threat’s initial stages and payload.
The vector categorisation is useful if you wantto know how many threats were sent in as email
attachments (23), for example, and how many
were introduced via a collaboration tool like
Slack (10).

7

Breach Response Test: Kaspersky Anti Targeted Attack Platform3. Threat Details
All of these attack types have been witnessed in

Other threats include well-known and prevalent

the market about targeted attack testing using

real-world attacks over the previous few years.

banking malware used in widely-spreadthe full attack chain, just as we perform it. In fact,

They are representative of a real and present

campaigns; threats used to serve malware throughwe take things further than ATT&ACK does, bythreat to business networks the world over.

online advertisements; and threats aimed directly

rolling out attacks with different options, but it’s

The threats used in this test are similar or identicalat financial institutions.

fair to say that the way we test is an extension

to those used by the following threat groups.
Attributions are taken from public sources:APT19 A Chinese group believed to haveof MITRE ATT&ACK.
When the US non-profit company The MITRE
Corporation released details of its ATT&ACK

MITRE’s ATT&CK techniques include the following,

framework we rejoiced. MITRE effectively educated

all of which are included in our testing:targeted defence, energy, telecommunications
and other industries.
APT28 Thought to be connected with Russian
military cyber operations, APT28 targets

THREAT DETAILS
Attack Technique

ExamplesInitial Access

Spear Phishing Link (a link to a malicious file on a website sent in an email to a
specific user on the target network).

Execution

Malware, script or exploit is run on the targeted endpoint.

Persistence

Add a new service that starts automatically on reboot.

Privilege Escalation

Exploitation of Windows to gain more powerful access to the system.

APT32 This supposedly Vietnam-based group

Defence Evasion

File-less attacks using scripts that do not write their own code to the hard disk.

predominantly focusses on private businesses

Credential Access

Credential dumping of encrypted passwords.

Discovery

Listing user accounts.

Lateral Movement

Logging into other systems on the same network from the compromised target.

Collection

Logging keystrokes from the user’s keyboard.

Command and Control

Remote access though encrypted connections.

Exfiltration

Uploading stolen data to systems controlled by the attacker.

ImpactDeletion or encryption of important files on the target systems.

government, military and security organisations.
APT29 Thought to be connected with Russian
military cyber operations, APT29 targets
government, military and telecommunications
sectors.

and foreign governments as targets.
APT33 Focussing on aviation and energy
industries, this group is believed to be basedin Iran.
Sandworm A Russian-based group thatappears to target Ukrainian industry,
government and media organisations.

8

Breach Response Test: Kaspersky Anti Targeted Attack Platform

4. Threat Responses
Full Attack Chain: Testing every layer ofdetection and protection

demonstrate its abilities in behavioural detection

ATTACK CHAIN STAGES

and so on.

Attackers start from a certain point and don’t
stop until they have either achieved their goal or

Attack stages

have reached the end of their resources (which

The illustration below shows some typical stages

could be a deadline or the limit of their abilities).

of an attack. In a test each of these should beThis means, in a test, the tester needs to beginattempted to determine the security solution’s

the attack from a realistic first position, such as

effectiveness. This test’s results record detection

sending a phishing email or setting up an infected

and protection for each of these stages.

website, and moving through many of the likely
steps leading to actually stealing data or causing

We measure how a product responds to the firstsome other form of damage to the network.

stages of the attack with a detection and/ orprotection rating. Sometimes products allow

If the test starts too far into the attack chain,threats to run but detect them. Other times theysuch as executing malware on an endpoint, thenmight allow the threat to run briefly before

many products will be denied opportunities toneutralising it. Ideally they detect and block theuse the full extent of their protection and detection

threat before it has a chance to run. Products may

abilities. If the test concludes before any ‘useful’delete threats or automatically contains them in adamage or theft has been achieved, then similarly‘quarantine’ or other safe holding mechanism forthe product may be denied a chance tolater analysis.
Should the initial attack phase succeed we thenmeasure post-exploitation stages, which are
represented by steps two through to seven below.
We broadly categorise these stages as: Access(step 2); Action (step 3); Escalation (step 4); andPost-escalation (steps 5-7).
In figure 1. you can see a typical attack runningfrom start to end, through various ‘hacking’activities. This can be classified as a fully
successful breach.

9

Figure 1. A typical attack starts with an initial contact
and progresses through various stages, includingreconnaissance, stealing data and causing damage.

In figure 2. a product or service has interfered

It is also possible that attackers will not causewith the attack, allowing it to succeed only as

noticeable damage during an attack. It may be

far as stage 3, after which it was detected andthat their goal is persistent presence on theneutralised. The attacker was unable to progresssystems to monitor for activities, slowly steal

through stages 4 and onwards.

information and other more subtle missions.

It is possible for an attack to run in a different

In figure 3. the attacker has managed to progressorder with, for example, the attacker attempting

as far as stage five. This means that the system

to connect to other systems without needing tohas been seriously compromised. The attacker has

escalate privileges. However, it is common fora high level of access and has stolen passwords.

password theft (see step 5) to occur before

However, attempts to exfiltrate data from theusing stolen credentials to move further throughtarget were blocked, as were attempts tothe network.

damage the system.

ATTACK CHAIN: How Hackers Progress

10

Figure 2. This attack was initially

Figure 3. A more successful attack

successful but only able to progress

manages to steal passwords but wholesale

as far as the reconnaissance phase.

data theft and destruction was blocked.

Breach Response Test: Kaspersky Anti Targeted Attack Platform

5. Protection Ratings
The results below indicate how effectively thethe threat (see Detected, above), as this at least

Targeted Attack Scoringproducts dealt with threats. Points are earned

alerts the user, who may now take steps to secure

The following scores apply only to targeted attacks

for detecting the threat and for either blocking

the system.

and are cumulative, ranging from -1 to -5.

or neutralising it.

Rating Calculations
Detected (+1)
If the product detects the threat with any degree

Access (-1)

We calculate the protection ratings using the

If any command that yields information about thefollowing formula:target system is successful this score is applied.
Examples of successful commands include listingof useful information, we award it one point.
Protection Rating =current running processes, exploring the file system(1x number of Detected) +and so on. If the first command is attempted andThreats that are disallowed from even starting(2x number of Blocked) +the session is terminated by the product without

their malicious activities are blocked. Blocking(1x number of Neutralised) +the command being successful the score of

products score two points.

(1x number of Complete remediation) +Neutralised (see above) will be applied.

Blocked (+2)(-5x number of Compromised)
Neutralised (+1)

Action (-1)

Products that kill all running malicious processes

The ‘Complete remediation’ number relates to

If the attacker is able to exfiltrate a document from‘neutralise’ the threat and win one point.

cases of neutralisation in which all significant

the target’s Desktop of the currently logged in user

traces of the attack were removed from the target.

then an ‘action’ has been successfully taken.

Complete Remediation (+1)

Such traces should not exist if the threat was

If, in addition to neutralising a threat, the product‘Blocked’ and so Blocked results imply Complete

removes all significant traces of the attack, it

remediation.

gains an additional one point.

points are deducted.

how important these different outcomes are.
Post-Escalation Action (-1)

This result occurs when a product continually

You may have a different view on how seriously

blocks a persistent threat from achieving its aim,

you treat a ‘Compromise’ or ‘Neutralisation without

After escalation the attacker attempts actions

while not removing it from the system.

complete remediation’. If you want to create yourthat rely on escalated privileges. These include

own rating system, you can use the raw data fromattempting to steal credentials, modifying the file

7. Protection Details on page 13 to roll your own

system and recording keystrokes. If any of theseset of personalised ratings.

actions are successful then a further penalty ofCompromised (-5)
If the threat compromises the system, theproduct loses five points. This loss may be
reduced to four points if it manages to detect

11

The attacker attempts to escalate privileges to NT
Authority/System. If successful, an additional two

These ratings are based on our opinion of
Persistent Neutralisation (-2)

Escalation (-2)

Breach Response Test: Kaspersky Anti Targeted Attack Platform

one point deduction is applied.

PROTECTION ACCURACY RATINGS
Product
Kaspersky Anti Targeted Attack Platform

Protection
Accuracy Rating

Protection
Accuracy Rating (%)

313

92%

Kaspersky Anti Targeted Attack Platform
0

170

340

Protection Ratings areweighted to show thathow products handle
threats can be subtler
than just ‘win’ or ‘lose’.

6. Protection Score
This graph shows the overall level of protection,

For each product we add Blocked and Neutralised

making no distinction between neutralised andcases together to make one simple tally.

blocked incidents.

PROTECTION SCORES
Product

Protection Score

Kaspersky Anti Targeted Attack Platform

82

Kaspersky Anti Targeted Attack Platform
0

12

17

34

Breach Response Test: Kaspersky Anti Targeted Attack Platform

51

68

85

Protection Scores area simple count of how
many times a productprotected the system.

7. Protection Details
These results break down how each producthandled threats into some detail. You can see
how many detected a threat and the levels of

PROTECTION DETAILS
Product

Detected

BlockedComplete
Remediation

Neutralised

Compromised

Protected

85

82

70

0

3

82

protection provided.
Products sometimes detect more threats thanKaspersky Anti Targeted
Attack Platformthey protect against. This can happen when theyrecognise an element of the threat but aren’t

Defendedequipped to stop it. Products can also provide

Kaspersky Anti Targeted Attack Platform

protection even if they don’t detect certain threats.

Complete
Remediation

Some threats abort on detecting specific endpoint0

protection software.

This data shows in detail how each product handled the threats used.

17

34

51

68

85

Neutralised
Compromised

The following table lists the cases in which the
product protected against specific types of threat.

THREAT PROTECTION DETAILS
Product
Kaspersky Anti Targeted
Attack Platform

Exploit(File Format)

Exploit(File-less)

Injection

Injection(Evasion)

Script(Evasion)

Script(File-less)Protected

12

21

10

18

2

19

82

These results summarise the number of times the product protected against different threat types.

13

Breach Response Test: Kaspersky Anti Targeted Attack Platform

8. Legitimate Software Ratings
These ratings indicate how accurately the products
classify legitimate applications and URLs, while
also taking into account the interactions that eachproduct has with the user. Ideally a product will
either not classify a legitimate object or will classify
it as safe. In neither case should it bother the user.
We also take into account the prevalence(popularity) of the applications and websites usedin this part of the test, applying stricter penalties forwhen products misclassify very popular softwareand sites.
To understand how we calculate these ratings,
see 8.3 Accuracy Ratings on page 16.

LEGITIMATE SOFTWARE RATINGS
Product
Kaspersky Anti Targeted Attack Platform

Legitimate
Accuracy Rating

Legitimate
Accuracy Rating(%)

250

100%

Kaspersky Anti Targeted Attack Platform
0

14

50

100

150

Breach Response Test: Kaspersky Anti Targeted Attack Platform

200

250

Legitimate Software
Ratings can indicate
how well a vendor
has tuned its
detection engine.

8.1 Interaction Ratings
It’s crucial that endpoint security products not

None(Allowed)

Click to Allow(Default Allow)

Click to Allow/Block(No Recommendation)

Object is Safe

2

1.5

1

Object is Unknown

2

1

0.5

0

-0.5

B

Object is not Classified

2

0.5

0

-0.5

-1

C

Object is Suspicious

0.5

0

-0.5

-1

-1.5

D

Object is Unwanted

0

-0.5

-1

-1.5

-2

E

-2

-2

F

4

5

only stop – or at least detect – threats, but thatthey allow legitimate applications to install and run
without misclassifying them as malware. Such anerror is known as a ‘false positive’ (FP).
In reality, genuine FPs are quite rare in testing. In our
experience it is unusual for a legitimate application
to be classified as ‘malware’. More often it will beclassified as ‘unknown’, ‘suspicious’ or ‘unwanted’

Object is Malicious(or terms that mean much the same thing).

1

2

3

Click to Block(Default Block)

None(Blocked)A

We use a subtle system of rating an endpoint’s
approach to legitimate objects, which takes into
account how it classifies the application and how it
presents that information to the user. Sometimes
the endpoint software will pass the buck anddemand that the user decide if the application issafe or not. In such cases the product may make a
recommendation to allow or block. In other cases,
the product will make no recommendation, whichis possibly even less helpful.
If a product allows an application to install andrun with no user interaction, or with simply a brief

INTERACTION RATINGS

notification that the application is likely to be safe,

Product

it has achieved an optimum result. Anything else
is a Non-Optimal Classification/Action (NOCA).
We think that measuring NOCAs is more usefulthan counting the rarer FPs.

15

Breach Response Test: Kaspersky Anti Targeted Attack Platform

Kaspersky Anti Targeted Attack Platform

None (Allowed)

None (Blocked)

100

0Products that do not bother users and classify most applications correctly earnmore points than those that ask questions and condemn legitimate applications.

8.2 Prevalence Ratings
There is a significant difference between an

8.3 Accuracy Ratings

endpoint product blocking a popular application

LEGITIMATE SOFTWARE PREVALENCE
RATING MODIFIERS

such as the latest version of Microsoft Word andImpact Category

Rating Modifier

Very High Impact

5High Impact

4

less serious but still suspicious) is a big deal.

Medium Impact

3

Conversely, the outdated toolbar won’t have had

Low Impact

2

a comparably large user base even when it was

Very Low Impact

1

condemning a rare Iranian dating toolbar forInternet Explorer 6. One is very popular all over theworld and its detection as malware (or something

We calculate legitimate software accuracy
ratings by multiplying together the interaction
and prevalence ratings for each download
and installation:
Accuracy rating = Interaction rating x Prevalence
ratingIf a product allowed one legitimate, Medium impact

new. Detecting this application as malware may be

application to install with zero interaction with thewrong, but it is less impactful in the overall scheme

user, then its Accuracy rating would be calculatedof things.

Applications were downloaded and installed

like this:during the test, but third-party download sites
were avoided and original developers’ URLs

varying popularity and sorted them into fivewere used where possible. Download sites willseparate categories, as follows:

sometimes bundle additional components into

This same calculation is made for each legitimate

applications’ install files, which may correctly

application/site in the test and the results are

1. Very High Impact

cause anti-malware products to flag adware.

summed and used to populate the graph and table

2. High Impact

We remove adware from the test set because it

shown under 8. Legitimate Software Ratings on

3. Medium Impact

is often unclear how desirable this type of code is.

page 14.

4. Low Impact
5. Very Low Impact

The prevalence for each application and URL isestimated using metrics such as third-party

Incorrectly handling any legitimate application will

download sites and the data from Alexa.com’s

invoke penalties, but classifying Microsoft Word as

global traffic ranking system.

malware and blocking it without any way for theuser to override this will bring far greater penalties
than doing the same for an ancient niche toolbar.
In order to calculate these relative penalties, weassigned each impact category with a rating
modifier, as shown in the table above.

16

Accuracy rating = 2 x 3 = 6

With this in mind, we collected applications of

Breach Response Test: Kaspersky Anti Targeted Attack Platform

9. Conclusions

8.4 Distribution of
Impact Categories

This test exposed Kaspersky Anti Targeted Attack

This prevented them from causing any damage,Endpoint products that were most accurate in

Platform (KATA) to a diverse set of exploits, file-including data theft.

handling legitimate objects achieved the highest

less attacks and malware attachments, comprisingratings. If all objects were of the highest prevalence,

the widest range of threats in any currently

In some cases of neutralisation the attacks

the maximum possible rating would be 1,000 (100available public test. All of these attack types

created a connection to the attacker, who wasincidents x (2 interaction rating x 5 prevalence

have been witnessed in real-world attacks overthen unable to progress further. In three cases

rating)).

the previous few years. They are representative of

the injection with evasion attacks worked, but

a real and present threat to business networks the

only to a point. The tester was able to gain accessIn this test there was a range of applications withworld over. The threats used in this are similar or

to the target and steal some information about

different levels of prevalence. The table below

identical to those used by the threat groups listed

the system and from its filesystem. However, it

shows the frequency:

in 3. Threat Details on page 8.

was not possible to escalate privileges and steal
passwords, install keyloggers and modify the

LEGITIMATE SOFTWARE CATEGORY FREQUENCY
Prevalence Rating
Very High Impact

Frequency25

It is important to note that while the test usedfilesystem. This illustrates the need for full attack

the same types of attacks, new files were used.

chain testing: if a tester sees the connection

This exercised the tested product’s abilities tobeing made and assumes that the attack has

detect and protect against certain approaches tosucceeded then the results for that test would

attacking systems rather than simply detecting

not be accurate. Furthermore, an apparently

malicious files that have become well-known oversuccessful compromise might be more limited

the previous few years. The results are an indicator

than it first appears.

of potential future performance rather than justa compliance check that the product can detect

The results are strong and most attacks could

old attacks.

not progress far enough to the point at which thetesters would start hacking through the targets.

The product detected all of the threats andSometimes products are overly aggressive

protected fully against most. In 82 cases theand detect everything, including threats andthreats were unable to move beyond the earliest

legitimate objects. In this test Kaspersky Antistages of the attack chain, meaning that as soon

Targeted Attack Platform (KATA) generated noas the target systems were exposed to the threats,such false positive results, which is as expected.

the attacks were detected immediately and were

17

Breach Response Test: Kaspersky Anti Targeted Attack Platform

either blocked from running or, in 12 cases, were

Kaspersky Anti Targeted Attack Platform (KATA)

allowed to run only briefly before being neutralised.

wins a AAA award for its excellent performance.

Appendices
APPENDIX A: Terms Used
TERM

Compromised

MEANING

False positive

At the time of publication a later version was available.
The test was unsponsored.

the attacker was able to take remote control of the

The attack was prevented from making any changes toAll products were configured according to each vendor’s recommendations,when such recommendations were provided.

Malicious URLs and legitimate applications and URLs were independently

When a security product misclassifies a legitimate

located and verified by SE Labs.

application or website as being malicious, it generates aTargeted attacks were selected and verified by SE Labs.

The exploit or malware payload ran on the target but was
subsequently removed.
If a security product removes all significant traces of an

Remediation

attack, it has achieved complete remediation.

Target

The test system that is protected by a security product.
A program or sequence of interactions with the target
that is designed to take some level of unauthorised
control of that target.
Security vendors provide information to their products

Update

The test was conducted between October 2018 to February 2019.

the target.

Complete

ThreatT his test contains results for Kaspersky Anti Targeted Attack Platform v.2.0.

unhindered on the target. In the case of a targeted attack,‘false positive’.
Neutralised

A full methodology for this test is available from our website.

The attack succeeded, resulting in malware runningsystem and carry out a variety of tasks without hindrance.
BlockedAPPENDIX B: FAQs

Malicious and legitimate data was provided to partner organisations once
the test was complete.

SE Labs conducted this endpoint security testing on physical PCs, notvirtual machines.

Q
A

What is a partner organisation? Can I become one to gain access tothe threat data used in your tests?
Partner organisations benefit from our consultancy services after a test
has been run. Partners may gain access to low-level data that can be

useful in product improvement initiatives and have permission to use award
logos, where appropriate, for marketing purposes. We do not share data onin an effort to keep abreast of the latest threats. Theseone partner with other partners. We do not partner with organisations that

updates may be downloaded in bulk as one or more files,

do not engage in our testing.

or requested individually and live over the internet.

Q
A

I am a security vendor and you tested my product without permission.
May I access the threat data to verify that your results are accurate?
We are willing to share a certain level of test data with non-partner
participants for free. The intention is to provide sufficient data todemonstrate that the results are accurate. For more in-depth data suitablefor product improvement purposes we recommend becoming a partner.

18

Breach Response Test: Kaspersky Anti Targeted Attack Platform

Appendix C: Threat Types and Vectors
The following table categorises the attacks used

sent via email attachments but also how manyin the test according to vector and type. It also

were file format-based exploits; how many usedbreaks these details down into techniques used

executables that inject into memory; and how

by specific historical campaigns. For example, it ismany included (file-less) scripts that do notpossible to see not only how many threats weretouch the filesystem.

THREAT TYPES AND VECTORS
Threat Campaign Details

Exploit(File Format)

Exploit(File-less)

Injection

Injection(Evasion)

Script(File-less)

Script(Evasion)

Drive-by Compromise - APT 38

0

7

0

0

0

0

Hanjuan Exploit kit - Malvertising campaign

0

3

0

0

0

0

Web Browser Total

0

10

0

0

0

0

APT19 - Malicious RTF - Spearphishing
Attachment

3

0

0

0

0

0

Cactustorch, APT29, APT 33

0

0

0

0

6

0

Dridex - banking malware

0

0

0

0

3

0

Exploitation for Client Execution - APT32

1

3

0

0

0

0

Sandworm - Quadagh (Mitre says it might
be the same so stick with Sandworm)

6

0

0

0

0

0

Carbanak - Process Injection for evasion

0

0

0

1

0

0

Email Attachment Total

10

3

0

1

9

0

Web Browser

Email Attachment

19

Breach Response Test: Kaspersky Anti Targeted Attack Platform

THREAT TYPES AND VECTORS
Threat Campaign Details

Exploit(File Format)

Exploit(File-less)

Injection

Injection(Evasion)

Script(File-less)

Script(Evasion)

Drive-by Compromise - APT 38

0

8

0

0

0

0

Web Browser (IE) Direct Total

0

8

0

0

0

0

APT28 downloads and executes powershell
scripts

0

0

0

0

0

2

Exploitation for Client Execution - APT32

2

0

0

0

0

0

Carbanak - Process Injection for evasion

0

0

0

11

0

0

Web Browser (IE) Email Link Total

2

0

0

11

0

2

APT32- has used Powershell-based tools,
Powershell one-liners, and shellcode loaders
for execution.

0

0

0

0

10

0

Web Browser (Chrome) Email Link Total

0

0

0

0

10

0

Carbanak - Process Injection for evasion

0

0

0

9

0

0

Internal Web Server

0

0

0

9

0

0

0

10

0

0

0

0

10

0

0

0

Web Browser (IE) Direct

Web Browser (IE) Email Link

Web Browser (Chrome) Email Link

Internal Web Server

Web browser (Chrome) Slack

20

Dragonfly - Found samples in the wild with
Shellter signatures0

Web browser (Chrome) Slack Total

0

Breach Response Test: Kaspersky Anti Targeted Attack Platform

SE Labs Report Disclaimer
1.	The information contained in this report issubject to change and revision by SE Labs
without notice.
2.	SE Labs is under no obligation to update
this report at any time.
3.	SE Labs believes that the information
contained within this report is accurate
and reliable at the time of its publication,
which can be found at the bottom of thecontents page, but SE Labs does notguarantee this in any way.
4.	All use of and any reliance on this report,
or any information contained within thisreport, is solely at your own risk. SE Labs
shall not be liable or responsible for any
loss of profit (whether incurred directly
or indirectly), any loss of goodwill orbusiness reputation, any loss of data
suffered, pure economic loss, cost of
procurement of substitute goods orservices, or other intangible loss, or any
indirect, incidental, special orconsequential loss, costs, damages,
charges or expenses or exemplary
damages arising his report in any way
whatsoever.
5.	The contents of this report does notconstitute a recommendation, guarantee,
endorsement or otherwise of any of the
products listed, mentioned or tested.
6.	The testing and subsequent results do
not guarantee that there are no errors in
the products, or that you will achieve thesame or similar results. SE Labs does notguarantee in any way that the products
will meet your expectations,requirements, specifications or needs.
7.	Any trade marks, trade names, logos orimages used in this report are the trade
marks, trade names, logos or images of
their respective owners.
8.	The contents of this report are provided
on an “AS IS” basis and accordingly SE
Labs does not make any express or
implied warranty or representation
concerning its accuracy or completeness.

21

Breach Response Test: Kaspersky Anti Targeted Attack Platform