Detect and prevent info-stealers. Keep a Database of common file and maybe registry locations that info-stealers use. Like Popular Browser data locations, Popular software that info-stealers target, like Steam, Discord, etc and use methods like warning user when an un-signed package tries to access these locations.
Detect RATs: These are used by many hackers to watch what their victims are doing(WebCam, Screen, etc) and mess with them, runs scripts. Maybe detect Remote access protocols, not just ports. And alert user.
Detect Crypters(These are used to bypass anti-virus): Most Anti-Virus use blacklist signature detection. This is a problem for hackers because most use common RATs. So, criminals buy and use software called crypters. These just encrypt the malicious software so that they appear unknown to the Anti-Viruses. These crypters are constantly updated through the internet so that Anti-Viruses can’t keep up. By the time Anti-Virus signature is updated, most malware has updated to the latest version. This can be prevented by somehow detecting if the software is encrypted and shows the signs of a crypted executable. Rather than a simple Signature or Cetificate detection.
Hope peo
