App Review Comodo's killer.

[Nikola Milanovic]

if I were a business probably not fully
As a consumer it's too expansive for single licenses and is niche as it has too many false positives for many users but some can actually use it like my mom who doesn't install software frequently (using cruel sister comodo and configured defender there )

For myself only as a layer since there are wild malware with dll hijacking that can bypass It
Like the ransomware shown on this fourm

i alredy have machines with Xcitium Client Security and everything is fine

 

[Vitali Ortzi]

i alredy have machines with Xcitium Client Security and everything is fine

I'm using comodo (weaker version ) and everything is fine too
That's not a good way to measure unless you have thousands of devices with variations and targeted attacks too (for enterprises)

 

[Nikola Milanovic]

I'm using comodo (weaker version ) and everything is fine too
That's not a good way to measure unless you have thousands of devices with variations and targeted attacks too (for enterprises)

Xcitium Client Security has also Valkyrie.Auto.Malware@1 rating and Valkyrie.Manual.Malware@1 the ratings from Valkyrie

 

[Vitali Ortzi]

Xcitium Client Security has also Valkyrie.Auto.Malware@1 rating and Valkyrie.Manual.Malware@1 the ratings from Valkyrie

Valkyrie has too many false positives too although it can reduce it a lot over just purely blocking unknown

 

[Nikola Milanovic]

Valkyrie has too many false positives too although it can reduce it a lot over just purely blocking unknown

when i submit malware to Valkyrie i get verdicts from Valkyrie Automatic Analysis most of the time from Static Analysis and Dynamic Analysis

 

[rashmi]

The 7zFM is already included there via the rule *\7z*.exe . However, I want to fully virtualize only one archiver application set as the default archiver to open archives and disk images.
I do not know, maybe it is possible to fully virtualize all archives included in the File Archiver group and set one of them as the default archiver. Then, the Windows built-in archiver will be the only possibility to pack/open archives and disk images without containment.

With the "all applications" policy, Comodo will run files present in the file groups as fully virtual. For example, I had to add AntDM.exe for Ant Download Manager in the "file downloaders" group; otherwise, Comodo couldn't detect the file origin for the files downloaded. The file details showed the file origin as "unknown" for the downloaded files.

Did you export the test Comodo settings?

I had a 1-day limit for unrecognized apps, a file origin for removable media/internet, and a whitelist policy for WinRAR. I was just using File Explorer when I got a Comodo Firewall message; it crashed. Everything was fine except the test policies vanished and the unrecognized apps policy was back to default.

 

[rashmi]

@Andy Ful Is it possible for you to test CyberLock? How would their AI/Whitelist Cloud rate or analyze your signed POC?

 

[Andy Ful]

@Andy Ful Is it possible for you to test CyberLock? How would their AI/Whitelist Cloud rate or analyze your signed POC?

I do not plan to test CyberLock.
In my POCs, I used only benign and trusted applications/LOLBins. So, AI/Whitelist Cloud will rate them as benign and trusted. I am not sure about TDSSKiller, but you can check it.

Download Kaspersky TDSSKiller 3.1.0.28 for Windows - Filehippo.com

Download Kaspersky TDSSKiller 3.1.0.28 for Windows. Fast downloads of the latest free software! Click now

filehippo.com

 

[Andy Ful]

With the "all applications" policy, Comodo will run files present in the file groups as fully virtual. For example, I had to add AntDM.exe for Ant Download Manager in the "file downloaders" group; otherwise, Comodo couldn't detect the file origin for the files downloaded. The file details showed the file origin as "unknown" for the downloaded files.

I am not sure how the above is related to containing 7ziFM?
By "fully virtualize" 7zFM I meant that all files contained in the disk image or archive will be virtualized (not only "All Application" group).
For example, when opening a picture embedded in the ISO file or ZIP archive, the application that opens pictures will be auto-contained too.
When you open a document with a macro that creates/drops/runs payloads, the Word and all payloads will be auto-contained (also Trusted by Comodo).
The copy of the file is auto-contained.
The unpacked content is auto-contained.

 

[Andy Ful]

I realized the advantage of using the less than 1-day time limit + UniGetUI installer/updater.
First it is necessary to install UniGetUI from Microsoft Store. Next we should add the "Ignore" Actions to avoid Comodo's blocks.

The TmpFiles is the containment group for ignored file extensions. I added only the *.tmp file extension to this group.
With these settings, both the application installations/updates via UniGetUI and the execution of those applications are not blocked by Comodo. This follows from:

1. The installed UniGetUI preserves the original file creation time (always beyond the 1-day limit).
2. Most applications installed via UniGetUI also preserve the original creation time (always beyond the 1-day limit).
3. UniGetUI executes the application installers in two folders (see the screenshot above) that are 'Ignored' so Comodo does not contain the installation.
4. If the application uses *.tmp executables (which have a fresh creation time), they are also "Ignored."

 

[vitao]

Comodo/Xcitium has improved its signatures you can ask @vitao

no. they didnt. as far as i can tell, they improved only for a couple of days when someone from comodo was signing files from malwarebazaar but after a few days all was back to normal as cis continued to be the worst in detecting malwares in manual scans. but it continues to be the best when prevention is the goal.

 

[Nikola Milanovic]

no. they didnt. as far as i can tell, they improved only for a couple of days when someone from comodo was signing files from malwarebazaar but after a few days all was back to normal as cis continued to be the worst in detecting malwares in manual scans. but it continues to be the best when prevention is the goal.

The guy is still feeding the Malware database

 

[rashmi]

I realized the advantage of using the less than 1-day time limit + UniGetUI installer/updater.
First it is necessary to install UniGetUI from Microsoft Store. Next we should add the "Ignore" Actions to avoid Comodo's blocks.

View attachment 287182

The TmpFiles is the containment group for ignored file extensions. I added only the *.tmp file extension to this group.
With these settings, both the application installations/updates via UniGetUI and the execution of those applications are not blocked by Comodo. This follows from:

1. The installed UniGetUI preserves the original file creation time (always beyond the 1-day limit).
2. Most applications installed via UniGetUI also preserve the original creation time (always beyond the 1-day limit).
3. UniGetUI executes the application installers in two folders (see the screenshot above) that are 'Ignored' so Comodo does not contain the installation.
4. If the application uses *.tmp executables (which have a fresh creation time), they are also "Ignored."

For UniGetUI installer/updater users, simply adding "ignore" rules for the WindowsApps and UniGetUI folders should work with the default containment rules. A *.tmp file rule set to "ignore" in containment might also not be necessary.

 

[vitao]

The guy is still feeding the Malware database

well, i did an "fast test" here... same old same old...

 

[Andy Ful]

For UniGetUI installer/updater users, simply adding "ignore" rules for the WindowsApps and UniGetUI folders should work with the default containment rules. A *.tmp file rule set to "ignore" in containment might also not be necessary.

The "Ignore" feature works for installation via UniGetUI but not for the installed Unrecognized files in "Program Files", and other locations. So, after installation with UniGetUI the Unrecognized applications will be still contained. When using the 1-day time limit those Unrecognized applications will be mainly allowed, because most installations preserve the original file creation time (created by the vendor). Of course, another solution would be adding the application folders to the "Ignored" folders.
Some installed applications create the *.tmp files each time on execution - they are created with the fresh dates. They are mainly unsigned and often blocked even with the 1-day time limit, except when using "Ignore" rule for *.tmp. One could add the folder %LocalAppdata%\temp to "Ignored" folders, but this would be unsafe.

 

[Nikola Milanovic]

Xcitium is working on improving detection

 

[New_Style_xd]

From my tests here that I am doing, the CIS database is not being fed with malware.
There are threats that are more than 7 days old that the CIS is not detecting.

 

[Nikola Milanovic]

From my tests here that I am doing, the CIS database is not being fed with malware.
There are threats that are more than 7 days old that the CIS is not detecting.

i Subbmited to CIS SHA1 and the Comodo Staff FlorinG Blacklisted them you have to wait because they procced files from many other sources as well

 

[Nikola Milanovic]

i Subbmited to CIS SHA1 and the Comodo Staff FlorinG Blacklisted them you have to wait because they procced files from many other sources as well

i did a test again and CIS blocked everything with Cloud

 

[Andy Ful]

Guys, we should not focus on the general detection. The attack in the video is related to abusing Trusted EXE files via DLLs and other fileless methods. It would be more interesting if one could test the fresh malicious DLL samples. One month ago I did such a test (signature scan) on 50 one-day-old DLL samples from Malware Bazaar. Most of the popular AVs detected almost all samples and Comodo detected almost nothing. Such tests should be repeated independently by others to see if there is some improvement.