Your EDR Doesn't Know 40% of the Malware Mars Found. That's Why We Built Mars Prevention

Last month, Mars found that our customers' EDRs didn't recognize 40% of the malware files Mars's threat intel pipeline had identified.

Here's how Mars got there.

From threat reports to tailored rules

Mars read 1,800 threat reports from hand-picked sources. Together, they represent the combined knowledge of the industry and the open-source community, available to all of our customers as part of our coverage service and intelligence feed. The Mars platform uses this data to build hundreds of detection rules unique to each customer's environment to hunt for the TTPs and IOCs in these reports. It's all automatic, driven by AI and tailored to each customer's organizational profile, because Mars knows each customer's data sources and environment in depth.

The question we asked

In one month alone, Mars extracted thousands of malicious indicators from hundreds of relevant campaigns. So we asked a simple question about our customers' EDRs: do they already know these indicators? Will a Defender customer have full coverage of all these IOCs? Will a CrowdStrike customer? What about SentinelOne? Would they block them anyway? Or does Mars know something they don't, something worth acting on beyond an alert?

To answer it, Mars didn't rely on a single source. It checked every indicator against dozens of reputation sources, from the big, well-known security vendors to smaller, specialized ones, to see if the security world already knew it and how many of them flagged it.

What we found

The answer surprised us:

40% of the malware files Mars identified weren't recognized by our customers' EDRs.

According to research and industry estimates, antivirus updates take 72 hours on average, and can take weeks.

We knew Mars had something valuable, and we had to do more with it.

Introducing Prevention

That's why we built Prevention. Mars checks every indicator against the customer's own environment before suggesting a block. It runs a fast hunt with Mars's search engine to see whether the indicator has already shown up there, so every suggestion comes with the evidence to trust it.

Where we're heading

Mars will manage block lists end to end, from a report to a block, right in the customer's own EDR, adding and removing indicators as needed, at a pace no human could ever keep up with.

Cleaning up the block list

Along the way, Mars found a lot of mess in these lists:

• Indicators that were added but never enforced, because of how each EDR actually handles each indicator type.
• Lots of needless duplicates cluttering the list.
• Noisy indicators that keep firing alerts nobody needs, noise that can simply be cut.

Mars now detects and surfaces all of these, so prevention actually works and stays fast. IOCs change fast, but Mars is faster…