eelsasser wrote:
If a HTML page has an <a href="file.exe"> link to a .dll or .exe, The payload heuristics modify that page to the client and add a parameter to the link like <a href="file.exe?specialwatermarkparameter=uniquevalue">
If a user clicks the link manually, the MWG knows that a user clicked it and the GAM engine scans it normally.
If the request doesn't have the watermark, the GAM engine scans it more aggressively because the paramter wasn't included in the request.
This way, there is some indication that it was user-initiated vs. unsolicited download of an .exe or .dll, which could be an indication of a dropper.
This seems like a pretty slick feature that I first heard about at FOCUS last week.
I'm intrigued by it, but I'm curious to hear from anyone using it... how much legit stuff does it break? It seems like something invasive enough to have a surprising amount of edge cases, especially with things like java, perhaps multimedia, anything using wget legitimately, or the like. Curious what others' experience has been with this outside of a test lab.
