Now you may be wondering, how does it know? How does deep packet inspection and antivirus,
basically endpoint protection on those individual systems, how do those programs know what's good
and what's bad? Well, that's based on the actual definitions. And there are two ways that we do
this. We either do a signature based or a, now work with me here, I've been practicing heuristic
based detection. I'm getting better at it. For those that have been with me in previous courses,
this has been a tongue twister for me. Now I'm going to briefly cover these two before we start
getting into examples. Signature based is where we take a file, for instance, and run it up against
something that we know that's been based on hard coded definitions. For example, the hash of the
actual file itself. See the contents of the file will generate a hash. And if that hash is in a
hash table of known baddies, then our signature based definitions will tell the endpoint protection
system to say, get rid of that file because it's already a known bad. So it'll either put it in
quarantine, delete it or whatever the case may be. Now, heuristically, if a file does a certain thing
or performs a certain activity based on the rules in the heuristic side of the house, it may or may
not move that file over into the quarantine or delete it. Now, there are many methods for us to
be able to go through and check signatures. Again, we mentioned the hash already, but let's say, for
instance, we create a file and it must have venom and just change a couple of things inside of it.
Well, we know that changing the contents of that file will also change the hash.
So using a hash table would kind of invalidate the signature based detection, would it not?
Well, signature base goes even further and can even pinpoint some of the activity inside of the
code itself. So if there are snippets of code that match certain things, let's say like a reverse
shell call using Netcat is our prime example. And going through that file and taking a look at
everything, then the signature base would just say, hey, I found this string of code that's
supposed to be doing X, Y, and Z. I don't like it. It's going to throw it in quarantine or delete it
based on that signature. And there are many other traits that we can put in signature based as well,
such as specific API calls, functions being performed on the system that are either allowed
or not allowed based on how that signature is built. And when we look at the heuristic side,
it's basically how does the file or the action perform in accordance with what is tolerable and
considered sociable norms on the system, not in real life. So for an example, that same very same
file could have passed signature based detection for whatever reason. And once the file is being
ran, well, it tries to do a ping flood or basically ICMP flood against a bunch of selected
targets. Well, multiple types of ICMP traffic and irregular ICMP traffic connections might be a rule
inside of the heuristic based rule set and says, hey, you sure are using a lot of ICMP traffic.
I'm going to have to quarantine you or delete you because that's not allowed.
Now, there are many different ways that we can craft heuristic based rules, and those rules
cover a whole lot of different things. But one thing I really want to point out here before we
move any further is, is that if you make the rules as detailed as possible and go that extra mile
and make it so granular that it has to be precise to make it through, you're basically going to end
up dossing yourself. And that's because you have so much security that everything's just turned off
at that point. So there has to be a middle ground between secure and also availability. For those
that are keeping up in current affairs, Cloudflare just went through this. And because they went
through and added in a bunch of definitions to their signature based and heuristic based
rule sets for traffic detection, they dossed themselves because all traffic met the criteria
of being sent to the side and told not to enter. And so that's the nickel and dime of the actual
Cloudflare anomaly that happened second or third week of November 2025, if you're watching this,
in the future. So using those rule sets and basing all of our inspection on those rule sets,
that's why endpoint protection has the advantage when it comes to dealing with some of that
activity. Because the packet and file has made it to the actual endpoint system and is being
looked at before it actually finds a permanent home on the system and can be examined
and further, depending on your group policy and how your organization manages its security settings,
it may even send up to build further definitions, be it signature or heuristic,
based on the file that is trying to perform an action that is not allowed.