Not unappreciative, just stating the way things actually are. The scanners can generally only detect bad stuff either by signature or by "behaviors" in the wild. All I am agreeing with is that if an exploit uses methods to mask typical behaviors and doesn't match any known signature it can go unnoticed until something gets reported (as you pointed out). I am referring to the time incurred after the exploit is let loose until the time it gets reported, logged and a signature distributed where scanners become rather impotent in that instance.

 

Last edited: Mar 1, 2025 at 9:10 PM

Ok thank you !