Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1108781" data-attributes="member: 32260">I found another Comodo containment bypass (technique known for over 5 years) via VBA macro. That bypass is rarely used in the wild and allows the injection of the EXE file into Excel/Word. Comodo only sees that a trusted application does something (Excel.exe or Word.exe), so the EXE file is not contained.[ATTACH=full]286382[/ATTACH]In the screenshot above we can see the same application &quot;New GUI&quot; executed normally (contained by Comodo) and executed via office macro (not contained).Even if Comodo uses Paranoid HIPS the user has to be cautious because the HIPS alert informs only that Winword.exe tries to execute Winword.exe.Anyway, no need to worry if macros are not allowed. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Edit.I changed the screenshot (Killswitch in English).</blockquote>

[QUOTE="Andy Ful, post: 1108781, member: 32260"] I found another Comodo containment bypass (technique known for over 5 years) via VBA macro. That bypass is rarely used in the wild and allows the injection of the EXE file into Excel/Word. Comodo only sees that a trusted application does something (Excel.exe or Word.exe), so the EXE file is not contained. [ATTACH type="full"]286382[/ATTACH] In the screenshot above we can see the same application "New GUI" executed normally (contained by Comodo) and executed via office macro (not contained). Even if Comodo uses Paranoid HIPS the user has to be cautious because the HIPS alert informs only that Winword.exe tries to execute Winword.exe. Anyway, no need to worry if macros are not allowed. (y) Edit. I changed the screenshot (Killswitch in English). [/QUOTE]

Verification