Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1108799" data-attributes="member: 32260">Any method that blocks macros (also my DocumentsAntiExploit tool) can prevent that attack.I repeated the test with an enabled Internet connection (I am not sure If VirusScope uses a cloud backend):[ATTACH=full]286383[/ATTACH]Viruscope could not block the containment bypass, but it has some chances to mitigate some malicious actions of the payload. In my test, I used an unknown but benign payload &quot;New GUI&quot;. I initially disabled the Internet connections to be sure that Comodo could not add the file to the trusted group.I used hardened [USER=7463]@cruelsister[/USER] settings (all Script Analysis settings enabled).Comodo on reasonable settings cannot contain such attacks, but it can detect the payload by signatures or some malicious actions can be blocked by VirusScope/HIPS.The attack can be contained using a virtual desktop to open the weaponized document. Edit.I wrote &quot;containment bypass&quot; but (more precisely) it is an auto-containment bypass.</blockquote>

[QUOTE="Andy Ful, post: 1108799, member: 32260"] Any method that blocks macros (also my DocumentsAntiExploit tool) can prevent that attack. I repeated the test with an enabled Internet connection (I am not sure If VirusScope uses a cloud backend): [ATTACH type="full" alt="1732131314874.png"]286383[/ATTACH] Viruscope could not block the containment bypass, but it has some chances to mitigate some malicious actions of the payload. In my test, I used an unknown but benign payload "New GUI". I initially disabled the Internet connections to be sure that Comodo could not add the file to the trusted group. I used hardened [USER=7463]@cruelsister[/USER] settings (all Script Analysis settings enabled). Comodo on reasonable settings [COLOR=rgb(184, 49, 47)][B]cannot contain such attacks[/B][/COLOR], but it can detect the payload by signatures or some malicious actions can be blocked by VirusScope/HIPS. [COLOR=rgb(0, 168, 133)]The attack can be contained using a virtual desktop to open the weaponized document. [/COLOR] Edit. I wrote "containment bypass" but (more precisely) it is an auto-containment bypass. [/QUOTE]

Verification