Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 619911">Check the COMODO HIPS settings that he used\shows in the COMODO video.&nbsp; HIPS is set to Paranoid mode, but he sets HIPS alerts to OFF and to Allow Requests.&nbsp; Also, he enabled Create Rules for Safe Files.Those settings ensure that cmd.exe and powershell.exe will be allowed to execute without any alerts because both are rated as Safe by COMODO.&nbsp; With those settings he effectively neutered HIPS Paranoid mode for the demonstration.From CIS documentation...<ul>
<li data-xf-list-type="ul">Do NOT show popup alerts - Configure whether or not you want to be notified when the HIPS encounters a malware. Choosing &#039;Do NOT show popup alerts&#039; will minimize disturbances but at some loss of user awareness. (Default = Disabled).&nbsp; If you choose not to show alerts then you have a choice of default responses that CIS should automatically take – either &#039;Block Requests&#039; or &#039;Allow Requests&#039;.</li>
<li data-xf-list-type="ul">Create rules for safe applications - Automatically creates rules for safe applications in HIPS Ruleset (Default = Disabled).</li>
</ul>In short, he is using settings\configurations in all the videos that I actually bothered to watch to ensure cmd and powershell are whitelisted or not monitored.&nbsp; I didn&#039;t watch every single video.&nbsp; He is using PowerShell Empire in some, Metasploit in others, and whatever else.PowerShell Empire takes advantage of the fact that cmd and powershell are whitelisted by the vast majority of antivirus\internet security suites.At least some of those tested softs can be tweaked by the user to alert upon initiation and during the &quot;demonstration.&quot;&nbsp; Don&#039;t ask me how; research it and figure it out so it is permanently written on the inside of your skull.[USER=178]@Umbra[/USER] asked him to show ALL settings, rules, etc for each video.&nbsp; Do you think the guy is actually going to honor that request and explain why he using the specific settings\configuration that he uses ?</blockquote>

[QUOTE="509322, post: 619911"] Check the COMODO HIPS settings that he used\shows in the COMODO video. HIPS is set to Paranoid mode, but he sets HIPS alerts to OFF and to Allow Requests. Also, he enabled Create Rules for Safe Files. Those settings ensure that cmd.exe and powershell.exe will be allowed to execute without any alerts because both are rated as Safe by COMODO. With those settings he effectively neutered HIPS Paranoid mode for the demonstration. From CIS documentation... [LIST] [*][B]Do NOT show popup alerts[/B] - Configure whether or not you want to be notified when the HIPS encounters a malware. Choosing 'Do NOT show popup alerts' will minimize disturbances but at some loss of user awareness. ([I][B]Default = Disabled[/B][/I]). If you choose not to show alerts then you have a choice of default responses that CIS should automatically take – either 'Block Requests' or 'Allow Requests'. [*][B]Create rules for safe applications - [/B]Automatically creates rules for safe applications in HIPS Ruleset [I][B](Default = Disabled).[/B][/I] [/LIST] In short, he is using settings\configurations in all the videos that I actually bothered to watch to ensure cmd and powershell are whitelisted or not monitored. I didn't watch every single video. He is using PowerShell Empire in some, Metasploit in others, and whatever else. PowerShell Empire takes advantage of the fact that cmd and powershell are whitelisted by the vast majority of antivirus\internet security suites. At least some of those tested softs can be tweaked by the user to alert upon initiation and during the "demonstration." Don't ask me how; research it and figure it out so it is permanently written on the inside of your skull. [USER=178]@Umbra[/USER] asked him to show ALL settings, rules, etc for each video. Do you think the guy is actually going to honor that request and explain why he using the specific settings\configuration that he uses ? [/QUOTE]

Verification