Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 774706" data-attributes="member: 32260">Test continuation with script trojan-downloaders.The testing scripts adopted 7 different methods of downloading files and 8 different methods of executing files from scripts. I used VBScript and PowerShell.Kaspersky Internet Security 2019 (KIS).KIS detection (AMSI support) was much better as compared to all tested products. It detected all trojan-downloaders, but over 50% samples were allowed to run as Low Restricted.Most VBScript samples were quarantined, except a few which were allowed as Low Restricted.All scripts which used Bitsadmin were blocked (could not run as Low Restricted).All PowerShell scripts were allowed to run as Low Restricted - that is not a perfect solution, because of the below note from Kaspersky (<a href="https://support.kaspersky.com/11157#block1" target="_blank">How to configure applications&#039; rights and protected resources&#039; properties by using Application Control in Kaspersky Internet Security 2015</a>):&quot;...However, these applications have received low value of the threat rating (a special index that shows how dangerous an application could be for the system based on a number of criteria). They are allowed to perform some operations, such as accessing other processes, controlling the system, and accessing the network without notifying the user. However, the user&#039;s permission is required for most operations.&quot;It would be much better to block them or run as High Restricted.One can ask the similar question as for Bitdefender. Why some scripts are blocked and the rest are not? Most VBScript samples did the same as PowerShell samples.KIS can also benefit from <s>adopting an additional application for</s> script blocking.</blockquote>

[QUOTE="Andy Ful, post: 774706, member: 32260"] [B]Test continuation with script trojan-downloaders.[/B] The testing scripts adopted 7 different methods of downloading files and 8 different methods of executing files from scripts. I used VBScript and PowerShell. [COLOR=rgb(0, 168, 133)][B][SIZE=18px]Kaspersky Internet Security 2019[/SIZE][/B][/COLOR] (KIS). KIS detection (AMSI support) was much better as compared to all tested products. It detected all trojan-downloaders, but over 50% samples were allowed to run as Low Restricted. Most VBScript samples were quarantined, except a few which were allowed as Low Restricted. All scripts which used Bitsadmin were blocked (could not run as Low Restricted). All PowerShell scripts were allowed to run as Low Restricted - that is not a perfect solution, because of the below note from Kaspersky ([URL='https://support.kaspersky.com/11157#block1']How to configure applications' rights and protected resources' properties by using Application Control in Kaspersky Internet Security 2015[/URL]): "...[I]However, these applications have received low value of the threat rating (a special index that shows how dangerous an application could be for the system based on a number of criteria). They are allowed to perform some operations, such as accessing other processes, controlling the system, and accessing the network without notifying the user. However, the user's permission is required for most operations[/I]." It would be much better to block them or run as High Restricted. One can ask the similar question as for Bitdefender. Why some scripts are blocked and the rest are not? Most VBScript samples did the same as PowerShell samples. [B]KIS can also benefit from [S]adopting an additional application for[/S] script blocking.[/B] [/QUOTE]

Verification