# Evaluation of Local Security Event Management System vs. Standard Antivirus Software
## 4 Experimental Results
The binary CertUtil.exe is executed at the beginning, which downloads the file with the malicious commands to the system. 5. The file \"**readme2.txt**\" containing the malicious code is stored in a path on the computer. 6. Afterwards, the binary MSBuild.exe is launched and it runs the contents of the file, in this case it contains C# code that executes PowerShell commands. 7. It is possible to observe how \"**microsoft.powershell.commands.management**\" is executed. 8. Policy compliance tests are carried out and also detected as events (8a, 8b), although they are not classified as risk events. The mapping of the steps described above onto MITRE ATT&CK and the Cyber Kill Chain is the following:  
* The step 1 corresponds to the MITRE ATT&CK tactic \"**Initial Access**\" and technique \"**T1566-Phishing**\" and \"**Delivery**\" action in the Cyber Kill Chain. * The step 2 corresponds to the MITRE ATT&CK tactic \"**Execution**\" and technique \"**T1204-User Execution**\" and \"**Exploitation**\" action in the Cyber Kill Chain. * The step 3 corresponds to the MITRE ATT&CK tactic \"**Persistence**\" and technique \"**T1137-Office Application Startup**\" and \"**Installation**\" action in the Cyber Kill Chain. * The steps 4 and 5 correspond to the MITRE ATT&CK tactic \"Defense Evasion\" and technique \"**T1292-Indirect Command Execution**\" and \"**Installation**\" action in the Cyber Kill Chain. * The step 6 corresponds to the MITRE ATT&CK tactic \"**Defense Evasion**\" and technique \"**T1127-Trusted Developer Utilities Proxy Execution**\" and \"**Installation**\" action in the Cyber Kill Chain. * The step 7 corresponds to the MITRE ATT&CK tactic \"**Execution**\" and technique \"**T1059-Command and Scripting Interpreter**\" and \"**Exploitation**\" action in the Cyber Kill Chain. The Event-based detection system (EBDS) proposed is able detect all malicious activity, because the malware always triggers an event classified as high-risk by MITRE. Even in the case of using obfuscation methods, EBDS can detect the attack once the original code is restored and key components (such as PowerShell) are executed. On the other hand, static analysis of the malicious file is not able to detect the key components because the payload is encrypted. The comparison between the performance of different antivirus software, using techniques such as obfuscation and extracting malicious payloads in-memory, is shown in the following tables. Table 2, without obfuscation, shows that most malware codes are detected by several commercial antivirus packages. However, after applying different obfuscation methods, detection is much harder (Tables 3-5). It is also important to mention that most antivirus are giving an alarm because they detect the obfuscation technique, giving a warning of \"suspicious file\", but not detecting the malware itself. As an example, code B is not detected by BitDefender without obfuscation (Table 1), but it is detected when using AES encryption (Table 2), clearly because the use of encryption tools is raising the flag, since the payload cannot be read until executed. This detection strategy typically yields false positives if the user works with legitimate encrypted or coded files. We were able to prove such behavior by creating a harmless PowerShell code to just display a \"hello world\" message and obfuscating the file using AES; this file was also detected as malicious by several antivirus programs. The file was uploaded to VirusTotal [77; 78] on 18 May 2021, and it was labeled as malicious by 9 antivirus programs.