Three Ways Your Old Antivirus Software Is Leaving Your Business Vulnerable to Criminals

Signature Lag - Your Antivirus Is Always A Day Late To The Party

A signature is a fingerprint. It says "if you ever see a file whose SHA-256 hash or pattern matches this sequence, treat it as malware." Signature databases are shipped to your endpoint as updates, sometimes hourly, sometimes every few hours. That model only works if the pattern you are looking for already exists in the database. The moment a new variant ships, the database is blind until a researcher captures a sample, analyzes it, extracts a signature, pushes an update, and every endpoint on earth pulls that update down.

The gap between "new malware exists in the wild" and "your antivirus knows about it" is called signature lag. For serious ransomware crews, that gap is their entire business model. They do not have to defeat your antivirus. They only have to ship a build that has not been seen before. Tools like Cobalt Strike, Brute Ratel, and Sliver - legitimate penetration testing frameworks that attackers have weaponized - ship with built-in packers and obfuscators that mutate the binary on every compile. Signature matching cannot keep up because there is no stable signature to match.

Polymorphic malware takes this a step further. Instead of shipping a new build once, polymorphic malware rewrites itself on every infection. The file dropped on victim A has a different hash than the file dropped on victim B, even though the underlying behavior is identical. Signature engines cannot coalesce those into a single entry because, by the rules of their own model, they are different files. Your antivirus vendor would have to ship millions of signatures to catch a single campaign. They do not, because they cannot.

We have worked cases where a victim had current, paid, fully updated signature-based antivirus installed on every endpoint in the environment, the executive assistant opened a phishing attachment, and the resulting implant ran untouched for eleven days while attackers mapped the network and staged data for exfiltration. The antivirus console showed green the entire time.

Why signatures fail here

• Zero-day binaries have, by definition, no prior signature. Every ransomware crew with a functioning build pipeline produces zero-day binaries on demand.
• Packing and cryptors wrap a real payload inside layers of obfuscation that unpack in memory. The disk artifact is random bytes that signature engines cannot profile.
• Indicators of Compromise (IOCs), which are what signatures really are, describe the past. They never describe what is happening right now.

What a modern EDR does instead

EDR platforms ignore the file and watch the behavior. Instead of asking "is this hash bad," they ask "is this process doing things that legitimate software does not do on this endpoint." That is a completely different question. A freshly compiled ransomware binary with zero signatures in any database still exhibits a consistent set of behavioral indicators - enumerating volume shadow copies, calling CryptoAPI functions in rapid succession across thousands of files, writing new files with high-entropy contents next to every original, spawning from an Office process, and so on. EDR picks up on the combination, not the file. The behavior cannot hide because the behavior is the attack.

Petronella Technology Group deploys EDR as the foundation layer of every managed cybersecurity engagement and layers a 24/7 managed detection and response service on top so that the alerts generated by EDR are triaged by a real human plus AI analyst within minutes, not waiting for someone to open a ticket the next business morning.

Fileless And Living-Off-The-Land Attacks - The Malware Your Antivirus Cannot See Because It Never Touches Disk

Signature-based antivirus needs a file to scan. No file, no scan, no detection. That is not a hypothetical limitation. It is the entire reason the attacker class of "living-off-the-land" techniques exists and has dominated mid-sized business intrusions for the last five years.

Living-off-the-land, often abbreviated LOLBAS or LOLBins (Living-Off-the-Land Binaries and Scripts), refers to attackers using tools that are already on your machine. Windows ships with PowerShell. Windows ships with Windows Management Instrumentation (WMI). Windows ships with certutil.exe, bitsadmin.exe, mshta.exe, regsvr32.exe, wmic.exe, rundll32.exe, and a dozen other signed Microsoft binaries. Each of those tools, in the right hands, can pull code from the internet, decode it, execute it in memory, and never write a file to disk that an antivirus engine could scan.

A typical fileless attack chain we see in incident response looks like this. The user receives a phishing email with a link. The link runs a JavaScript blob inside the browser that calls PowerShell via a signed Windows helper. The PowerShell pulls a base64-encoded payload from a hosting service, decodes it into memory, and injects a Cobalt Strike beacon directly into the memory space of an already-running process like explorer.exe or svchost.exe. There is no malicious executable on disk. There is no file for signature antivirus to inspect. The only "file" involved is powershell.exe itself - which is signed by Microsoft, ships with Windows, and is on every antivirus whitelist on earth.

Mimikatz is another canonical example. Mimikatz is a credential dumping tool that extracts cached passwords, Kerberos tickets, and NTLM hashes from the LSASS process memory. Classic Mimikatz exists as a file, and most antivirus engines have signatures for it. Modern attackers do not care. They reflectively load Mimikatz directly into memory from a base64 string pulled down by PowerShell. The Mimikatz binary never exists on disk in any form your scanner can see.

Why signatures fail here

• The malicious logic lives in RAM, not on disk. Traditional antivirus has no memory visibility. It scans files and sometimes boot sectors.
• The executing process is signed and trusted. Flagging powershell.exe or wmic.exe as malicious would break every administrator script, scheduled task, and software deployment in the organization.
• The chain of execution crosses multiple processes. Each individual link looks mundane. Only the full sequence is suspicious, and signature engines do not reason about sequences.

What a modern EDR does instead

EDR platforms hook into Windows kernel telemetry and memory introspection APIs. They can see when PowerShell spawns a child process that injects into another process. They can see when WMI is invoked to execute a command remotely. They can dump LSASS memory access attempts. They can correlate parent-child process relationships across minutes and tag anomalies. In our deployments we also turn on the Antimalware Scan Interface (AMSI) so that PowerShell scripts get inspected at the moment the runtime interprets them - even if the payload is obfuscated, decoded only in memory, and never written to disk.

Our Petronella Managed XDR engagements extend EDR with script content rules for the specific LOLBin chains we see abused most often. When a user-context process launches PowerShell with encoded commands that reach out to a non-corporate domain, we do not need a signature to know what is happening. The pattern itself is the detection.

The Ransomware Pre-Detonation Phase - By The Time Your Antivirus Reacts, The Attackers Have Been Living On Your Network For Weeks

Business owners hear "ransomware" and picture the moment the screen locks with a payment demand. That is the final few minutes of a ransomware engagement. Everything of consequence happens before it.

A professional ransomware operation in 2026 follows a pattern that is nearly identical across crews like LockBit, BlackCat / ALPHV, Akira, Play, and their affiliates. Initial access comes from a phishing email, an exposed remote desktop service, a vulnerable VPN appliance, or a purchased credential from an initial-access broker. Once inside, attackers spend days to weeks - public industry research and the Mandiant M-Trends reports put the median dwell time in the range of single-digit to low double-digit days - moving laterally, stealing credentials, mapping the Active Directory forest, identifying the backup server, identifying the file servers with customer data, disabling shadow copies, and staging data for exfiltration. Only at the very end do they deploy the actual ransomware binary and encrypt the environment.

If your only security layer is a signature-based antivirus, here is the problem. The encryption binary is the first part of the attack that looks like "malware" to an antivirus scanner. Credential theft looks like normal process access. Lateral movement using legitimate admin tools looks like normal admin work. Data exfiltration over HTTPS to a cloud storage service looks like normal internet traffic. Your antivirus only wakes up at step nine, after steps one through eight have already happened. By then the attacker has your backups disabled, your data copied, your domain controller compromised, and a patient finger hovering over the trigger.

In our managed detection and response engagements we have pulled victims out of the pre-detonation window before the encryption fired. In every single one of those cases, the EDR alerted on a specific step - credential dumping, unusual kerberoasting, abnormal scheduled task creation, or a domain controller replication from an unexpected account. None of those alerts would ever have been produced by a signature engine, because none of those steps involve novel files.

Why signatures fail here

• The pre-detonation phase uses legitimate tools. PsExec, net.exe, wmic, RDP, robocopy, 7-Zip, rclone, and MegaCmd are all signed and legitimate. A signature engine cannot distinguish an attacker from an administrator.
• The damage happens before encryption. Exfiltrated data is already gone by the time ransomware fires. Victims who pay the decryption ransom still face extortion over leaked data.
• Backup disablement is a single-command action. wbadmin delete catalog, vssadmin delete shadows, wevtutil cl security - these are native Windows commands that signature antivirus will never flag.

What a modern EDR plus managed XDR does instead

Behavioral analytics are the difference. EDR knows that the service account "backup_admin" has never logged in to the finance file server in its entire recorded history, and flags it when it suddenly does. EDR sees when vssadmin.exe is launched from a process tree that originated in Outlook. EDR notices that fifty gigabytes just got copied to a newly registered domain from a host that normally sends two megabytes of email per day. No signature could ever express any of those rules. They are correlations across time and telemetry, and that is what EDR platforms are built to do.

A managed XDR service, which is what Petronella Technology Group actually delivers day-to-day, takes this further. We correlate endpoint telemetry with identity telemetry from Microsoft Entra ID, email security logs from Microsoft 365 or Google Workspace, firewall and network traffic logs, and cloud workload telemetry. The pre-detonation phase of a ransomware attack is extremely loud once you are looking at the whole picture. It is only quiet if all you have is a file scanner. See our endpoint detection and response service for how the EDR foundation layer fits together with the broader XDR pipeline.

Bonus - Supply Chain And Signed Malware - When Your Antivirus Trusts The Attacker's Code Because It Is Cryptographically Signed

Signature-based antivirus relies heavily on code-signing trust. If a binary is signed by a certificate issued to a reputable software vendor, most antivirus engines treat that binary as less suspicious and sometimes skip analysis entirely. Attackers have spent the last six years systematically attacking that trust model.

Three public cases changed the industry's understanding of signed malware. The SolarWinds Orion compromise in 2020 shipped a malicious update as a fully valid, code-signed component of a trusted enterprise monitoring product. Every antivirus on the planet allowed it because the signature on the update was legitimate - SolarWinds really did sign that build. The CCleaner compromise in 2017 did the same thing. The 3CX VoIP desktop client compromise in 2023 did it again. In each case, attackers gained access to the build pipeline of a legitimate software vendor and injected malicious code into a product that was then signed and distributed through the vendor's own update mechanism.

Beyond full-vendor compromises, attackers also buy and steal code-signing certificates on underground marketplaces. We have seen malware signed with certificates issued to legitimate but unrelated companies - a small German software house, a Taiwanese driver vendor, a defunct U.S. game studio. A signature-based antivirus that down-weights signed binaries will miss all of them.

Why signatures fail here

• Code-signing trust is a binary yes-or-no. Either the signature validates or it does not. Antivirus engines generally cannot reason about whether a signed binary is behaving appropriately for what it claims to be.
• Vendor-trusted binaries execute with reduced scrutiny. Many legacy antivirus products explicitly exempt signed vendor software from deep inspection to avoid performance and false-positive issues.
• The update mechanism itself is the infection vector. By the time the malicious update is on your machine, the vendor's own trust chain has already endorsed it.

What a modern EDR plus XDR does instead

EDR does not grant signed binaries a free pass. The SolarWinds Orion malware made outbound connections to domain infrastructure that did not match anything Orion had ever contacted before. The 3CX malware pulled encrypted payloads from GitHub-hosted icons - which is not something a legitimate softphone does. Behavioral telemetry picked up both cases long before the signatures were revoked. An EDR with properly tuned allowlisting and behavioral rules will flag "trusted application doing untrusted thing" as exactly what it is.

In Petronella Managed XDR engagements we combine EDR telemetry with DNS and egress monitoring from network detection layers so that if a signed binary starts beaconing to a newly registered domain, we know within seconds. For customers on our managed IT services in Raleigh, NC that network layer is part of the standard stack.

Bonus - MFA Bypass And Session Token Theft - The Attack Your Antivirus Does Not Even Know Is Happening

The last failure mode is the one most likely to surprise a business owner. You have heard the advice to turn on multi-factor authentication. You have turned it on for Microsoft 365, for your banking portal, and for your remote access. You are still exposed, and your antivirus will never tell you.

Modern phishing-as-a-service kits like EvilProxy, Tycoon, and Mamba 2FA perform adversary-in-the-middle attacks. The victim clicks a phishing link and lands on a pixel-perfect replica of the Microsoft 365 login page. The victim enters their password. The phishing kit relays the password to the real Microsoft endpoint in real time. Microsoft sends back an MFA prompt to the user's phone. The user approves it, thinking they are signing in to their own account. The MFA approval is accepted by Microsoft, which then returns a session cookie to the phishing kit - not to the user. The attacker now has a valid, fully MFA-authenticated session token for the victim's mailbox, OneDrive, SharePoint, and Teams. The user's password and MFA were both technically used correctly. The attacker ends the session with a working set of cloud credentials.

Related variants include cookie theft directly off the endpoint. A legitimate-looking browser-extension install or a malicious Python package pulled by a developer's IDE can exfiltrate cookie stores from Chrome, Edge, or Firefox. Those cookies include refresh tokens for Microsoft 365, Google Workspace, Slack, GitHub, and every SaaS the user is logged into. No password is ever stolen, no MFA is ever bypassed in the traditional sense, and yet the attacker ends up sitting inside the victim's cloud identity.

Why signatures fail here

• There is no malicious file on the endpoint during an adversary-in-the-middle phish. The attack happens entirely in the browser and in the cloud auth flow.
• Cookie exfiltration looks like legitimate browser traffic. Signature engines do not monitor what data leaves the browser's process memory.
• Signature antivirus has no model of identity. It does not know who "you" are in terms of which sessions are legitimate and which are not.

What a modern EDR plus identity-aware XDR does instead

EDR agents with browser telemetry can flag unusual extension installations, abnormal cookie store access, and credential theft tools. XDR pipelines pull sign-in logs from Microsoft Entra ID and flag impossible-travel events, sign-ins from residential proxies and hosting provider IPs, and new device enrollments that follow a risky session. That is how Petronella Managed XDR catches adversary-in-the-middle phishing cases: not on the endpoint alone, and not in the cloud alone, but in the correlation. Our AI-assisted threat analysis layer triages the sign-in anomaly and alerts our human analysts in minutes, at any hour, including weekends and holidays.