App Review Comodo Internet Security vs targeted ransomware attack.

[Andy Ful]

Comodo nails @cruelsister's tests but fails @Andy Ful's ...

However, we both agree that Comodo nails at home, if one can live with @cruelsister's settings.

 

[Andy Ful]

However, the attack presented in the video was easily detected by Microsoft Defender (I did not submit the DLL to analysis).
...
That is why the attackers avoid this method in the wild. They use other attack vectors optimized to bypass popular AVs.

I tried Bitdefender Total Security. It blocked the attack behaviorally.

The attack was successful when Advanced Threat Defense was disabled.

 

[Parkinsond]

I tried Bitdefender Total Security. It blocked the attack behaviorally.

View attachment 295908

May I say MD behavioral analysis was comparable to that of B?

 

[Andy Ful]

May I say MD behavioral analysis was comparable to that of B?

Bitdefender Advanced Threat Defense is more aggressive.
It also includes something similar to MD ASR rules.

 

[Parkinsond]

Bitdefender Advanced Threat Defense is more aggressive.
It also includes something similar to MD ASR rules.

But the ultimate result is blocking the attack post-execution by both.

 

[Andy Ful]

But the ultimate result is blocking the attack post-execution by both.

Microsoft Defender detected the DLL on the pre-execution level. Bitdefender did not detect the DLL, but it did detect the abused EXE's actions upon execution.

 

[Andy Ful]

Microsoft Defender can block the attack on execution via the ASR rule:

Event[0]:
Time Created : 25/02/2026 13:42:48
ProviderName : Microsoft-Windows-Windows Defender
Id : 1121
Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
For more information please contact your IT administrator.
ID: c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb
ConfigureDefender option: Block use of copied or impersonated system tools
Detection time: 2026-02-25T12:42:48.415Z
User: ahome\andrzej
Path: E:\H_C\DLL\ComodoBypassAAABBB\OPEN_ME.EXE
Process Name: C:\Windows\explorer.exe
Target Commandline:
Parent Commandline: C:\WINDOWS\Explorer.EXE
Involved File:
Inheritance Flags: 0x00000000
Security intelligence Version: 1.445.242.0
Engine Version: 1.1.26010.1

 

[rashmi]

However, we both agree that Comodo nails at home, if one can live with @cruelsister's settings.

Overall, Comodo is effective for home users, regardless of configuration, except for those involved with cracks, keygens, and mods. I doubt the upcoming version will address any issues related to trusted malware or services; if I recall correctly, Xcitium offers solutions for these through the console or profile.

 

[Parkinsond]

Microsoft Defender can block the attack on execution via the ASR rule:

One nice false positive block by same ASR rule while installing Yandex

 

[Andy Ful]

One nice false positive block by same ASR rule while installing Yandex

View attachment 295983

Yes, explorer.exe in the temp directory is very suspicious. However, there is a simple solution. Set this ASR rule temporarily to Audit.

 

[Parkinsond]

Yes, explorer.exe in the temp directory is very suspicious. However, there is a simple solution. Set this ASR rule temporarily to Audit.

I have used "unblock" and will observe if it will be triggered again after 24 hours, or it just was one time alert during install.

 

[Andy Ful]

Here is a similar example in the wild (InfoStealer), although it also uses shell code. It would be interesting to test it against Comodo to see how strong Comodo's shell code injection protection is.
https://thehackernews.com/2026/03/sloppylemming-targets-pakistan-and.html?m=1
https://malwaretips.com/threads/slo...using-dual-malware-chains.140014/post-1173685

There is a difference compared to my video. In the case of video, the targets were machines with Comodo protection. The in-the-wild example had probably a more general purpose, although it was still a targeted attack against government entities and critical infrastructure operators in some countries (not against home users). Home users are safe (so far).

There is also a second infection chain in the article (Excel VBA Macro + DLL hijacking = keylogger). This one also has great chances to bypass Comodo.