# Evaluation of Local Security Event Management System vs. Standard Antivirus Software
## 3 Methodology and Implementation
### Implementation and Execution of Experimental Tests  
The execution of the tests was performed based on known malicious code and techniques, which commercial antivirus systems already include in their signature databases or detect by means of heuristic algorithms that they have implemented. All of them were executed on a completely updated Microsoft Windows 10 operating system. The description of the malicious codes follows:  
**Code A:** Powercat.ps1 is a PowerShell script equivalent to the Netcat tool that allows to open ports, to perform remote connections or do port scanning [69]. Figure 2: Event Based Detection System (EBDS) Diagram. **Code B:** ConPtyShell.ps1 is a PowerShell script that uses the CreatePseudoConsole() function within Windows 10 version 1809 and allows the execution of a remote command console [70]. **Code C:** Invoke-PowershellTCP.ps1 is a PowerShell script that is part of the Nishang collection and allows the execution of a remote command console [71]. **Code D:** MeterpreterTCP.ps1 is a PowerShell version of one of the payloads generated by the Metasploit framework [72], that has a very wide set of functionalities and executes in memory, hence offering significant undetectability. **Code E:** Mimikatz.ps1 is an open-source application that allows attackers to obtain information on the target system, such as stored credentials or Kerberos tickets [73]. **Code F:** Meterpreter.exe is the executable version of malicious code previously mentioned in \"**Code D**\". In addition, we made use of macros 4.0 (XML) in Excel documents, which are compatible with current Microsoft Office systems [74] and represent one of the techniques currently used to reduce the detection. We also added the use of signed operating system binaries, known as LOLBins [75], to conduct code execution once the document has been opened. **Code G:** The Microsoft Excel document contains a macro 4.0 that runs a local command console using the MSBuild.exe binary. **Code H:** The Microsoft Excel document contains a macro 4.0 that first downloads the file with malicious code using CertUtil.exe and then executes it using MSBuild.exe, as presented in the previous case. Similarly, we have used Visual Basic for Applications (VBA) in Microsoft Office documents. Although these are very well-known, this has allowed us to obtain an approach for the results that we have obtained with our implementation. **Code I:** The Microsoft **Word** document contains a Visual Basic for Applications (VBA) macro that download and execute a malicious code using PowerShell directly into memory. In order to study the current state of the art in obfuscated malware detection, 11 commercial threat detection and classification (antivirus) systems were used. Different virtual machines were created with a clean updated Windows 10 installation and one antivirus at a time. After basic initial testing of the aforementioned malware code, three different obfuscation methods were implemented to perform additional tests, consisting of encryption using AES algorithms, substitution of function names and known text strings, and encryption using XOR algorithm. **AES (Advanced Encryption Standard) encryption**: It is a symmetric block cipher, i.e., it operates on groups of bits of fixed length and applies invariant transformations to them. The size of the blocks it handles is 128-bits and uses 128, 192, and 256-bit encryption keys. **String substitution**: A simple way to evade antivirus systems in some cases is the substitution of known function names with random ones. As a result, it is possible to avoid identification by modifying the code signature that is compared with the one stored in the antivirus system's database. **XOR encryption**: It is a symmetric encryption based on the XOR logical operator and performs this operation bit by bit.