Reply to thread

Message

<blockquote data-quote="Parsh" data-source="post: 875208" data-attributes="member: 58090">From what I can make of the alert text, it reports that a potentially suspicious application has been detected, not that a suspicious behavior is identified.If that is true, I doubt if it&#039;s Deep Behavioral Inspection that triggered the alert. DBI as they say is an extension of HIPS.In the Detection Engine tab, you have adjustable levels of &#039;suspicious applications&#039; to be detected. And this is also present in the &#039;On-demand scans&#039; parameters. So I believe that these two are different in the view that<ol>
<li data-xf-list-type="ol">Detection Engine &gt;&gt; Suspicious Applications uses static/dynamic analysis of code to see if the file is suspicious (your case)</li>
<li data-xf-list-type="ol">HIPS &gt;&gt; DBI monitors activity of actually run apps to see if actions are suspicious</li>
</ol>Since the detected file is a setup, I guess it was detected on static scan/when trying to run it. Alright, your new post says it alerts on download too. So it should not be the DBI.</blockquote>

[QUOTE="Parsh, post: 875208, member: 58090"] From what I can make of the alert text, it reports that a potentially suspicious application has been detected, not that a suspicious behavior is identified. If that is true, I doubt if it's [U]Deep Behavioral Inspection[/U] that triggered the alert. DBI as they say is an extension of HIPS. In the Detection Engine tab, you have adjustable levels of [U]'suspicious applications'[/U] to be detected. And this is also present in the 'On-demand scans' parameters. So I believe that [U]these two[/U] are different in the view that [LIST=1] [*]Detection Engine >> Suspicious Applications uses static/dynamic analysis of code to see if the file is suspicious (your case) [*]HIPS >> DBI monitors activity of actually run apps to see if actions are suspicious [/LIST] Since the detected file is a setup, I guess it was detected on static scan/when trying to run it. Alright, your new post says it alerts on download too. So it should not be the DBI. [/QUOTE]

Verification