- Jan 6, 2022
- 435
Any replacements for Microsoft Defender Exploit Protection?
- Thread starter Victor M
- Start date
- Jan 6, 2022
- 435
Xeno1234
Level 14
- Jun 12, 2023
- 699
- Jan 6, 2022
- 435
Xeno1234
Level 14
- Jun 12, 2023
- 699
- Oct 3, 2022
- 380
Hi @Rita , That was an interesting video. Thanks.
However, it shows the Kaspersky for Server edition. I have heard different things about protections offered by different editions of a product. Some say that the same protection is available in all editions. Some say you have to specifically buy a certain edition to get a certain protection feature. I tend to believe the latter. What does everybody have to say about that?
In my case, I have Kaspersky Premium.
Anyways, the red team test their tools against common AV's before deploying them. So the chances are great that Kaspersky will fail.
However, it shows the Kaspersky for Server edition. I have heard different things about protections offered by different editions of a product. Some say that the same protection is available in all editions. Some say you have to specifically buy a certain edition to get a certain protection feature. I tend to believe the latter. What does everybody have to say about that?
In my case, I have Kaspersky Premium.
Anyways, the red team test their tools against common AV's before deploying them. So the chances are great that Kaspersky will fail.
Last edited:
- Jan 6, 2022
- 435
You need more layers and to be holistic. You can't teach that.
I've setup windows xp laptops for fun and still red teams were rage quitting
Their words were, it's unfair as we cannot even communicate with the targets. I said Find a way. Little do they know that windows firewall kicked their butts due to my policies. They couldn't even get to execution or exploitation.
I've setup windows xp laptops for fun and still red teams were rage quitting
Their words were, it's unfair as we cannot even communicate with the targets. I said Find a way. Little do they know that windows firewall kicked their butts due to my policies. They couldn't even get to execution or exploitation.
- Oct 3, 2022
- 380
Hi @Sandbox Breaker ,
Unfortunately my red team don't know the word 'quit'.
Since we are talking about firewalls, what do you think of this config: Setup Idea - Default Deny Windows Firewall setup How To
There Are other layers in my defenses. But the whole point of this test is to test the abilities of OpenEDR and it's included Comodo Internet Security. I don't like Comodo's firewlall policy and have replaced with the above and added MalwareBytes' Anti-exploit. But I have kept their other protections. And their sales person is pitching me to upgrade to their 'advanced' package. I queried their support about the ability to detect and stop Metasploit's shell Meterpreter on friday, they have kicked the query to the advanced team, but they haven't responded yet.
It's great to be in your shoes.
Unfortunately my red team don't know the word 'quit'.
Since we are talking about firewalls, what do you think of this config: Setup Idea - Default Deny Windows Firewall setup How To
There Are other layers in my defenses. But the whole point of this test is to test the abilities of OpenEDR and it's included Comodo Internet Security. I don't like Comodo's firewlall policy and have replaced with the above and added MalwareBytes' Anti-exploit. But I have kept their other protections. And their sales person is pitching me to upgrade to their 'advanced' package. I queried their support about the ability to detect and stop Metasploit's shell Meterpreter on friday, they have kicked the query to the advanced team, but they haven't responded yet.
Last edited:
- Jan 6, 2022
- 435
- Oct 3, 2022
- 380
Well, I look at it this way - at my age, if you don't teach, you are going to take it to your grave, or forget half of it after you retire. You just take walks with your dog and watch TV. Unless you plan to go back to school and get that Masters degree to keep your mind young. That's should not be taken to mean that my advice is always the best approach.
Last edited:
- Jan 6, 2022
- 435
- Oct 3, 2022
- 380
Xeno1234
Level 14
- Jun 12, 2023
- 699
Business protection (besides Adaptive Anomaly Control) doesnt differ from the home protection - according to someone who I talked to understands K alot.
Hi @Victor M
It's present equally in all Kaspersky products. Enterprise versions may have additional controls, but the basic protection is the same
How to enable and configure Automatic Exploit Prevention in Kaspersky Internet Security 20
Learn how to use Kaspersky Internet Security 20 to protect your computer against malware that exploits application and operating system vulnerabilities.
support.kaspersky.com
Enable or disable exploit protection
support.kaspersky.com
Exploit Prevention | Kaspersky
This technology reveals and blocks in real time the malware's attempts to benefit from software vulnerabilities.
www.kaspersky.com
Last edited by a moderator:
Also, any program, no matter how powerful, may fail because there is no complete protection, but I do not think it is a good idea to assume a high failure rate for either Kaspersky or other protection programs before testing
- May 31, 2017
- 1,662
You probably already know this, but please make sure you disable the option "Automatically deactivate after 10 minutes of system idle" in CyberLock Settings / Basic tab prior to the red team testing. CyberLock is designed to protect the endpoint while the user is engaging in risky activities, so we left this option on by default. We should probably automatically disable this option after 2-4 weeks, or prompt the user to see if they would like to disable this option at that time. Also, please remember when testing CyberLock, to reset the whitelist when retesting a certain attack.
I would also like to mention that locking the endpoint down to the point where it is completely unusable is actually the easy part. The difficult part is to lock the endpoint down as tightly as possible, WHILE making it user-friendly enough to actually be able to use. For example, could you imagine if a military department was at war and they were unable to execute software necessary to complete their mission?
A wise women once asked me a simple question with an analogy while trying to make a point about security in general. Here question was "What is the best exercise equipment? (e.g. Bowflex, Peloton). Her answer was simply... "It is the one that you use".
Similar threads
