App Review Comodo Internet Security vs targeted ransomware attack.

[Andy Ful]

Comodo nails @cruelsister's tests but fails @Andy Ful's ...

However, we both agree that Comodo nails at home, if one can live with @cruelsister's settings.

 

[Andy Ful]

However, the attack presented in the video was easily detected by Microsoft Defender (I did not submit the DLL to analysis).
...
That is why the attackers avoid this method in the wild. They use other attack vectors optimized to bypass popular AVs.

I tried Bitdefender Total Security. It blocked the attack behaviorally.

The attack was successful when Advanced Threat Defense was disabled.

 

[Parkinsond]

I tried Bitdefender Total Security. It blocked the attack behaviorally.

View attachment 295908

May I say MD behavioral analysis was comparable to that of B?

 

[Andy Ful]

May I say MD behavioral analysis was comparable to that of B?

Bitdefender Advanced Threat Defense is more aggressive.
It also includes something similar to MD ASR rules.

 

[Parkinsond]

Bitdefender Advanced Threat Defense is more aggressive.
It also includes something similar to MD ASR rules.

But the ultimate result is blocking the attack post-execution by both.

 

[Andy Ful]

But the ultimate result is blocking the attack post-execution by both.

Microsoft Defender detected the DLL on the pre-execution level. Bitdefender did not detect the DLL, but it did detect the abused EXE's actions upon execution.

 

[Andy Ful]

Microsoft Defender can block the attack on execution via the ASR rule:

Event[0]:
Time Created : 25/02/2026 13:42:48
ProviderName : Microsoft-Windows-Windows Defender
Id : 1121
Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.
For more information please contact your IT administrator.
ID: c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb
ConfigureDefender option: Block use of copied or impersonated system tools
Detection time: 2026-02-25T12:42:48.415Z
User: ahome\andrzej
Path: E:\H_C\DLL\ComodoBypassAAABBB\OPEN_ME.EXE
Process Name: C:\Windows\explorer.exe
Target Commandline:
Parent Commandline: C:\WINDOWS\Explorer.EXE
Involved File:
Inheritance Flags: 0x00000000
Security intelligence Version: 1.445.242.0
Engine Version: 1.1.26010.1

 

[rashmi]

However, we both agree that Comodo nails at home, if one can live with @cruelsister's settings.

Overall, Comodo is effective for home users, regardless of configuration, except for those involved with cracks, keygens, and mods. I doubt the upcoming version will address any issues related to trusted malware or services; if I recall correctly, Xcitium offers solutions for these through the console or profile.

 

[Parkinsond]

Microsoft Defender can block the attack on execution via the ASR rule:

One nice false positive block by same ASR rule while installing Yandex

 

[Andy Ful]

One nice false positive block by same ASR rule while installing Yandex

View attachment 295983

Yes, explorer.exe in the temp directory is very suspicious. However, there is a simple solution. Set this ASR rule temporarily to Audit.

 

[Parkinsond]

Yes, explorer.exe in the temp directory is very suspicious. However, there is a simple solution. Set this ASR rule temporarily to Audit.

I have used "unblock" and will observe if it will be triggered again after 24 hours, or it just was one time alert during install.

 

[Andy Ful]

Here is a similar example in the wild (InfoStealer), although it also uses shell code. It would be interesting to test it against Comodo to see how strong Comodo's shell code injection protection is.
https://thehackernews.com/2026/03/sloppylemming-targets-pakistan-and.html?m=1
https://malwaretips.com/threads/slo...using-dual-malware-chains.140014/post-1173685

There is a difference compared to my video. In the case of video, the targets were machines with Comodo protection. The in-the-wild example had probably a more general purpose, although it was still a targeted attack against government entities and critical infrastructure operators in some countries (not against home users). Home users are safe (so far).

There is also a second infection chain in the article (Excel VBA Macro + DLL hijacking = keylogger). This one also has great chances to bypass Comodo.

 

[Andy Ful]

It is very hard to find an in-the-wild attack that could bypass Comodo. Probably impossible against home users.
However, here is a recent example (targeted attack on government entities) that uses twice the method presented in my video:

Malware News Thread 'Zscaler ThreatLabz has published a technical analysis of a targeted campaign against Middle East government entities.'

Yesterday at 9:45 PM

Introduction​

In July 2026, Zscaler ThreatLabz observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East. During analysis, ThreatLabz captured post-compromise activity and uncovered previously undocumented malware tooling, including TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign used a multi-stage attack chain to establish and maintain access on infected systems, with TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic...

• Khushal
• Replies: 1
• Forum: Security News

• 

The EXE files are benign/legitimate, so most AVs can also fail to detect the attack (as 0-day).
One of the used DLLs is still undetected by such strong AVs as Bitdefender, CrowdStrike Falcon, Elastic, GData, Eset, Emsisoft, Palo Alto Networks, TrendMicro, Xcitium, ZoneAlarm.
From VirusTotal, it follows that Xcitium did not detect any of the DLLs noted in the article, but it has an option to block unrecognized DLLs, which can block such attacks anyway.
If the attack accidentally happened at home, it could be blocked by SAC (DLLs are unsigned).

 

[annaegorov]

It is very hard to find an in-the-wild attack that could bypass Comodo. Probably impossible against home users.
However, here is a recent example (targeted attack on government entities) that uses twice the method presented in my video:

Malware News Thread 'Zscaler ThreatLabz has published a technical analysis of a targeted campaign against Middle East government entities.'

Yesterday at 9:45 PM

Introduction​

In July 2026, Zscaler ThreatLabz observed new activity by a threat actor with links to East Asia targeting government entities in the Middle East. During analysis, ThreatLabz captured post-compromise activity and uncovered previously undocumented malware tooling, including TELESHIM, MIXEDKEY, and BINDCLOAK. The campaign used a multi-stage attack chain to establish and maintain access on infected systems, with TELESHIM abusing the Telegram API for command-and-control (C2) communication to blend in with legitimate internet traffic...

• Khushal
• Replies: 1
• Forum: Security News

• 

View attachment 298951
The EXE files are benign/legitimate, so most AVs can also fail to detect the attack (as 0-day).
One of the used DLLs is still undetected by such strong AVs as Bitdefender, CrowdStrike Falcon, Elastic, GData, Eset, Emsisoft, Palo Alto Networks, TrendMicro, Xcitium, ZoneAlarm.
From VirusTotal, it follows that Xcitium did not detect any of the DLLs noted in the article, but it has an option to block unrecognized DLLs, which can block such attacks anyway.
If the attack accidentally happened at home, it could be blocked by SAC (DLLs are unsigned).

Does this defense lead us to believe Comodo will protect where others won't or would that be a misrepresentation of Comodo's abilities

 

[Andy Ful]

Does this defense lead us to believe Comodo will protect where others won't or would that be a misrepresentation of Comodo's abilities

There is no effective defence from Comodo against such attacks, due to poor detection of DLLs. This attack is still undetected by Comodo on VirusTotal after two weeks. One of the DLLs used in the attack has been undetected for 5 months. However, Comodo is intended for home use where such attacks are nonexistent, and it will indeed protect where others won't. That is why Comodo users can still consider it a good solution at home (so far).
Most AVs can also fail when this kind of malware is 0-day old, but will better protect afterwards.

 

[Andy Ful]

This thread is a kind of challenge for the following:

1. Comodo protection can be bypassed, but in the wild, this can happen only in highly targeted attacks.
2. Comodo has a few unpatched exploits, but no one bothers to exploit Comodo in the wild.
3. Comodo Internet Security (Comodo Firewall) is rather poorly supported, but this has no visible impact on its security at home.
4. Comodo has rather poor detection, but it does not affect the overall protection at home due to sandboxing unrecognized files and strong script blocking.

So far, Comodo wins the challenge. We will see how long.