# Evaluation of Local Security Event Management System vs. Standard Antivirus Software
## 4 Experimental Results  
The proposed methodology was evaluated for different categories of malware and obfuscation methods. The objective of the experiments is to show the effectiveness of event collection, the ability to match those events to the MITRE ATT&CK matrix and use that standard to determine if a threat is present of not. There are different attack vectors implemented in our experimental analysis that combine different tactics and techniques from the MITRE ATT&CK matrix. The evaluation is not based on individual malware samples, but on different attack vectors that ultimately implement actions that trigger system events detected by the proposed architecture. This is a more generalized assessment approach that targets non-existing malware or attack techniques and does not attempt to detect existing malware, because current antivirus can cope with such attacks. Because of the obfuscation applied, standard antivirus programs are in disadvantage for detecting the malware tested. However, the event-based strategy can detect high-risk events, according to the MITRE specification, for the malware. Any attack that triggers high-risk system events is potentially detectable with the proposed approach regardless of the obfuscation method implemented by the attacker. The event-bases detection system helps to perform complex analyses, such as experiments using Excel documents with macros 4.0, and signed operating system binaries. Code G and Code H include malware in the form of Excel macros. Their detail description follows:  
**Excel-Macro4.0-MSBuild-Cmd (Code G):** The execution graph obtained after running Code G on the virtual machine is shown in Figure 4  
Corresponding to the image in Figure 4, a detailed analysis of the events that have occurred in the system can be carried out, which allows for a comprehensive evaluation of the execution process:  
1. The user receives an Excel document which contains the macros 4.0 that allows malicious execution on the system. 2. Opening the document, the system calls the EXCEL.exe program. 3. Document \"**testapt1.xls**\" opens, and the user enables the execution of macros embedded in the document. 4. Excel calls the binary MSBuild.exe that executes the commands in the system. 5. As a result, command prompt is opened on the system. Figure 4: Result of the execution of an Excel document with MSBuild.exe. The mapping of the steps described above onto MITRE ATT&CK and the Cyber Kill Chain is the following:  
* The step 1 corresponds to the MITRE ATT&CK tactic \"**Initial Access**\" and technique \"**T1566-Phishing**\" and \"**Delivery**\" action in the Cyber Kill Chain. * The step 2 corresponds to the MITRE ATT&CK tactic \"**Execution**\" and technique \"**T1204-User Execution**\" and \"**Exploitation**\" action in the Cyber Kill Chain. * The step 3 corresponds to the MITRE ATT&CK tactic \"**Persistence**\" and technique \"**T1137-Office Application Startup**\" and \"**Installation**\" action in the Cyber Kill Chain. * The step 4 corresponds to the MITRE ATT&CK tactic \"**Defense Evasion**\" and technique \"**T1127-Trusted Developer Utilities Proxy Execution**\" and \"**Installation**\" action in the Cyber Kill Chain. * The step 5 corresponds to the MITRE ATT&CK tactic \"**Execution**\" and technique \"**T1059-Command-Line Interface**\" and \"**Exploitation**\" action in the Cyber Kill Chain. **Excel-Macro4.0-CertUtil-MSBuild-RevShell (Code H)**: The execution graph obtained after running this test is detailed in Figure 5:  
Figure 5: Result of Excel document execution with CertUtil.exe and MSBuild.exe. The following points detail the execution process, which allows for a detailed analysis of the events that have occurred in the system. 1. The user receives an Excel document containing macros 4.0 which allow malicious execution on the system. 2. When the user proceeds to open the document, the system calls the EXCELexe program. 3. The document \"**testapt2.xls**\" is opened and the user enables the execution of macros. 4.