Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 774718">TAM just blocks low reputation and unknown files.TAM will block a file and then Application Control will move it to the Low Restricted, High Restricted or Untrusted group. So, a file can be sent to Low Restricted based upon Application Control, but it is prevented from launching by TAM and the toggle switch is set to Block.It appears to me Kaspersky is relying upon AMSI and other protection mechanisms to deal with in-memory attacks. [USER=32260]@Andy Ful[/USER] might be right about how Kaspersky&#039;s engineering optimized KIS. However, it is difficult to know for sure without knowing the signatures, heuristics, KSN, Application Control as well as the rest of the modules and how they all work together.Anyone who gets the jist of things won&#039;t place a whole lot of trust in AMSI, ASR and other rules-based protections.You have to disable the interpreters and sponsors to decisively protect against in-memory only stuff.</blockquote>

[QUOTE="509322, post: 774718"] TAM just blocks low reputation and unknown files. TAM will block a file and then Application Control will move it to the Low Restricted, High Restricted or Untrusted group. So, a file can be sent to Low Restricted based upon Application Control, but it is prevented from launching by TAM and the toggle switch is set to Block. It appears to me Kaspersky is relying upon AMSI and other protection mechanisms to deal with in-memory attacks. [USER=32260]@Andy Ful[/USER] might be right about how Kaspersky's engineering optimized KIS. However, it is difficult to know for sure without knowing the signatures, heuristics, KSN, Application Control as well as the rest of the modules and how they all work together. Anyone who gets the jist of things won't place a whole lot of trust in AMSI, ASR and other rules-based protections. You have to disable the interpreters and sponsors to decisively protect against in-memory only stuff. [/QUOTE]

Verification