Software Review Comodo's challenge part 2.

[Sandbox Breaker - DFIR]

Curious to see how this works on a locked client. We use tamper protection with a custom password. Does that change anything?

 

[B-boy/StyLe/]

Well now like @Shadowra asked I am waiting to see if Kaspersky would pass the test.

But however, I am not sure Kaspersky uses VT-X for self-defense tho. In their site, it is described that VT-X is used mainly for enhanced detection of complex malware and not for protecting the drivers. But still will be interested to see it in action.

https://i.ibb.co/PD9gbjV/Image-737.png

About protection through hardware virtualization in Kaspersky applications

Overview of settings and features available in a Kaspersky application and guides on how to use them.

support.kaspersky.co.uk

 

[Andy Ful]

Do you use an attack similar to Stuxnet? This one used an LNK exploit and went undetected for a really long time. Or this is purely LOLbins attack?

No, it is completely different.

 

[Andy Ful]

In Script Analysis, one can add the missing ones.

Which one of several hundred?

 

[Andy Ful]

Curious to see how this works on a locked client. We use tamper protection with a custom password. Does that change anything?

Microsoft Defender?

 

[Sandbox Breaker - DFIR]

Microsoft Defender?

Xcitium. We have tamper protection with locked client Gui.

 

[Andy Ful]

Xcitium. We have tamper protection with locked client Gui.

Cannot test Xcitium. But if the Tamper Protection is based on the driver, it can be also disabled.

 

[Sandbox Breaker - DFIR]

Cannot test Xcitium. But if the Tamper Protection is based on the driver, it can be also disabled.

Understood. Thanks for your research and dedication to security as a whole! I highly respect and commend gentlemen of class such as yourself.

 

[wat0114]

@Andy Ful

as a software tester and one who offers invaluable advice, you are peerless. Your results can be taken to the bank without hardly a question and criticism. Your membership and involvement alone in this forum is the primary reason I joined in and remain a member of this forum. Thank you for everything you have contributed here.

 

[simmerskool]

Well now like @Shadowra asked I am waiting to see if Kaspersky would pass the test. It will be nice to see if Appguard will pass it as well.

^...and /or CyberLock too

 

[rashmi]

Which one of several hundred?

Everyone can have their favorite ones and live happily ever after, like a fairytale with a twist of personal preference.

 

[Andy Ful]

Everyone can have their favorite ones and live happily ever after, like a fairytale with a twist of personal preference.

After some time this fairy tale can twist to horror.

 

[rashmi]

After some time this fairy tale can twist to horror.

Well, the script is tailor-made for horror fans, with jump scares, suspenseful moments, and a guaranteed box office hit.

 

[Victor M]

@Andy Ful Was this test done on CIS BETA 2024 or CIS Production version?

 

[Andy Ful]

@Andy Ful Was this test done on CIS BETA 2024 or CIS Production version?

Videos are done on CIS Production version. The test was repeated on CIS BETA 2024:

https://malwaretips.com/threads/comodos-challenge-part-2.129514/post-1079005