What do you mean? I'm unsure, but I think the "File Age" rule should work in all scenarios; you can either add the file age criteria to the rules in the Internet Security config, or you can keep the "All Applications—Unrecognized—3 days" rule and disable the below rules.
COMODO Internet Security Pro 2027
- Thread starter Shadowra
- Start date
It is advised to take all reviews with a grain of salt. In extreme cases some reviews use dramatization for entertainment purposes.
This is a general rule for all files. The next rules modify it because they are more specific (valid for some groups of files).
As you can see in the test for BAT files from my previous post, the BAT file on the flash drive was still contained even 3 days after creation.
I meant Comodo should allow the file in all scenarios if you add the file age criteria to the containment rule/s. For example, Comodo should allow the BAT file on the flash drive after 3 days. Does editing the rule/s work, i.e., allow the BAT file on the flash drive?
This works if there are no other more specific rules
You can remove the "Removable Media" group from the rule below:
As you can see, the file age for this rule is unlimited.
The File Age rule in the CIS default configuration works for all supported file types, not only for BAT files. In my test, I used BAT files because they can be easily created.
@Andy Ful, I tested the BAT file scenarios (#Post97) using the default Internet Security config and kept the "All Applications—Unrecognized—1 hour(s)" rule while disabling the rules listed below.
With the default Internet Security config, after 1 hour, the test1 file runs outside the container, but both the test2 files run inside, as per KillSwitch.
With the edited config, after 1 hour, all files run outside the container, as per KillSwitch.
With the default Internet Security config, after 1 hour, the test1 file runs outside the container, but both the test2 files run inside, as per KillSwitch.
With the edited config, after 1 hour, all files run outside the container, as per KillSwitch.
Last edited:
So the File Age works, with one difference.
It is interesting because I repeated this test several times with consistent results.
My test was conducted in VirtualBox.
Edit.
Damn, I got a strange result. It seems that CIS works differently in VirtualBox and on a real machine.
I repeated the test on a real machine, and the test file downloaded from the same flash drive was still contained, even after the isolation time limit.
In the same test in VirtualBox, the file is not contained.
So one can be cautious when testing CIS in a virtual machine. It looks like in some nonstandard environments CIS may have trouble determining the origin of a downloaded file.
The good news is that such problems can hardly affect most users.
Last edited:
If we skip the exotic issue related to VirtualBox or similar nonstandard environments, we are left with files created directly on the hard disk. Even if some malware could use this to bypass CIS, it would first have to bypass CIS in another way, for example, by exploiting a Trusted process/application. In my opinion, this could be possible only in highly targeted attacks.
Anyway, one should be cautious when testing CIS in a virtual machine.
Anyway, one should be cautious when testing CIS in a virtual machine.
Yes, I've mentioned this several times in this forum, including in test threads. Comodo has had problems on virtual machines. I believe a virtual machine test isn't a perfect copy of a real system test; that's why I always test or confirm on a real system. Over the years, I've also seen products fail to install on light virtualization software like Shadow Defender and RollBack Rx; these same products installed fine on real systems.
Here we have an example that could bypass CIS:
The attack uses DLL hijacking and process hollowing (both not auto-contained). There is also a BAT file created on the hard disk for persistence, and it is auto-contained for at least 3 days (in the CIS default configuration). The question is: Will that BAT file be allowed after three days, like the BAT file created in my test? Can such an attack be dangerous to home users after three days?
The attack uses DLL hijacking and process hollowing (both not auto-contained). There is also a BAT file created on the hard disk for persistence, and it is auto-contained for at least 3 days (in the CIS default configuration). The question is: Will that BAT file be allowed after three days, like the BAT file created in my test? Can such an attack be dangerous to home users after three days?
Last edited:
I can help u answer that question by providing u with the initial payload! Also interestingly the final malware sample is classified by most AVs as AsyncRat.
sample sent w8ing for comodo vs this malware strain analysis.You're welcome.
I used the SVG file provided by @Khushal. After opening it in the web browser and clicking, it dropped the ZIP file via HTML smuggling. It was password-protected, but the password was noted in the article.
I unpacked the ZIP archive and executed the benign EXE file. However, the attack was contained to my surprise. I checked the benign file in Comodo Valkyrie, and it was unknown there. So this particular attack in the wild would fail.
Anyway, it would not fail if the file was known to Valkyrie (it is a legitimate and signed tool). Here is the screenshot from VT (hash 31450edef8fb19a13a0b968972aa1706ee3ac10416117c0d0ce4bb82171f362a):
To continue the test and see what can happen with the BAT file, I manually changed the rating to Trusted.
Now the DLL hijacking worked:
The malware created a special folder and copied there the needed files + the newly created BAT file. The Registry key was added for persistence to run this BAT.
After signing off/on, the BAT file was executed and auto-contained by CIS (as expected). I increased the date by 3 days and signed off/on again.
This time, the malware was not auto-contained. So, the persistence mechanism is delayed, but only by the CIS time isolation limit.
I unpacked the ZIP archive and executed the benign EXE file. However, the attack was contained to my surprise. I checked the benign file in Comodo Valkyrie, and it was unknown there. So this particular attack in the wild would fail.
Anyway, it would not fail if the file was known to Valkyrie (it is a legitimate and signed tool). Here is the screenshot from VT (hash 31450edef8fb19a13a0b968972aa1706ee3ac10416117c0d0ce4bb82171f362a):
To continue the test and see what can happen with the BAT file, I manually changed the rating to Trusted.
Now the DLL hijacking worked:
The malware created a special folder and copied there the needed files + the newly created BAT file. The Registry key was added for persistence to run this BAT.
After signing off/on, the BAT file was executed and auto-contained by CIS (as expected). I increased the date by 3 days and signed off/on again.
This time, the malware was not auto-contained. So, the persistence mechanism is delayed, but only by the CIS time isolation limit.
Yes, the newly created BAT will not be auto-contained after three days.
The average lifespan of malicious C2 servers often exceeds 7 days, so after 3 days, the attack can still be dangerous.
The incompleteness of Comodo Valkyrie ratings can be additional protection at home against attempts to abuse the Trusted binaries.
Last edited:
We already confirmed this with your BAT file tests; after 3 days, the newly created "local" file will run outside the container, and the newly created file from the "internet/intranet/removable drive" will run inside.
Not exactly. The creation was done in our tests by hand in Explorer. In the malware example, the creation was done by malware.
Such details can matter in the CIS case.
I tried CIS 2027 and I am pretty sure that if you have protonVPN installed and active (system wide), the firewall doesn't filter anything. I got no prompts. As soon as I disabled the VPN, I got prompts. Reminds me of Sygate firewall that had the so called "proxy hole", if I remember correctly. Shame, because I am trying to implement "defense in depth", but "HIPS" are no more in fashion (and now they are called EDR it seems). Ah, the good old days of Process guard, SSM, Online armor, etc. As a matter of fact, D+ with proactive security had once saved me from an infected USB stick of a neighbour. I got a prompt for new autostart registry entry when she inserted the USB key. I thought "why would a USB key trigger an autostart entry?". Antivirus didn't see anything... That was many years ago. Now it seems everyone is in love with AI and defense in depth consists of OS hardening.
Hello, Cruel Sister. If I may ask, aside from Comodo, what other programs (pardon me, I am old fashioned...I mean apps), would you recommend for someone who doesn't want to just rely on antivirus? As a matter of fact, now that most run Defender, I wonder how wise this is, since, I imagine that every bad guy out there must test his ware against Defender... So, no surprise that lately some exploits used Defender to gain root access.
It is the current firewall of Symantec endpoint protection.
You may also like...
-
-
ZOHO Endpoint Managed Antivirus 2026
- Started by Shadowra
- Replies: 7
-
Malwarebytes Anti-Malware Premium Re-Test
- Started by Shadowra
- Replies: 22
-
-
Qihoo 360 Total Security 2026 Free
- Started by Shadowra
- Replies: 16