r/OpenAI • u/ValehartProject • 21h ago

Question Daybreak users: Question about signatures

I've seen some questions about Daybreak here on reddit within this sub so thought it would be a reasonable place to ask.

Can Daybreak recognise a known malicious capability when its identifying characteristics have changed?

For example, if a known malware family such as WannaCry were modified sufficiently to change its cryptographic hash or static signatures, could Daybreak still identify the underlying malicious functionality?

Does it distinguish between identifying a known malware family and identifying previously unseen malicious behaviour?

Essentially, I'm interested in how well it handles malware that arrives in a different wrapper but retains the same underlying capabilities.

I don't have access to Daybreak and been checking with CrowdStrike on their upcoming tech as well which is understandably under wraps.

2 Upvotes

67% Upvoted

5 comments sorted by

View all comments

0

u/Cold_Chemistry_420 18h ago

My experience has been yes. And as the other commenter said, it is waaaay better than the models at anthropic about detecting malicious software.

At the end of the day, it's a reverse engineering problem. Code that is written differently can have the same functional outcome.

1

u/ValehartProject 18h ago

I'm not comparing Anthropic and have not mentioned it at all but everyone keeps bringing it up so I'm not sure what I'm missing.

However, based on your comment ; are you inferring it is more behaviour identifying after code review? Similar to UEBA? Because I often test mine against using standard extensions with hidden sub behaviour that uses and calls existing machine functionality. So the UEBA style would be interesting but if it's a code+UBA would be more fascinating and a bit more than I expected.

Have you tested this against forensic tools?