Harmony uses Kaspersky's engine for everything by default right, or is it sophos?
Evasive VBS with very low VT
- Thread starter Sandbox Breaker - DFIR
- Start date
- Status
This is ESET Endpoint trial version.Since when does LiveGuard have such an UI?
F
ForgottenSeer 93786
PDM is System Watcher.
F
ForgottenSeer 93786
Yes it is, you will only see the PDM prefix for System Watcher detections.
"The proactive defense module is a module that monitors the sequence of actions conducted by an application in the system, and if suspicious activity is detected, the application is blocked to prevent it from conducting further activity. If an object is detected by the PDM, the name of the object begins with the “PDM:” prefix." It was likely renamed to System Watcher at some point, they just just stuck with the PDM prefix for detections.
Last edited by a moderator:
About System Watcher
support.kaspersky.com
F
ForgottenSeer 93786
BSS is not a prefix they use for detections, when an item is detected by System Watcher it will always begin with "PDM:". BSS is how System Watcher works, and not a detection prefix.BSS would be system watcher. Behavioural Stream SignaturesmAbout System Watcher
Who cares lol. At least they block it at many layers.
This also means Check Point Harmony has system watcher.
Last edited by a moderator:
Doesn't that mean that Kaspersky added a signature after it was detected by System Watcher? And the signature however is available for Harmony as it's using the Kaspersky engine and therefor its signatures? I doubt that it can dynamically analyze malware with Kaspersky's behavioural and AI components.
Last edited by a moderator:
The PDM module runs locally. I've seen these seen these detections locally in Harmony before.
PDM can be seen in @Shadowra's test here so it is in Harmony. I am using it with Sophos, hence it reached the behavioural guard layer, where it was instantly annihilated. PDM is probably system watcher's telemetry based. Kaspersky has multiple signatures that can detect the threat.
Yes sir.
Harmony is the best value and so superior. I'm also using their mobile solutions. Cloud sandboxes are included with harmony Mobile.
So there is absolutely no delay in Kaspersky detections and Harmony with Kaspersky engine? And while all AVs with Bitdefender engine only get its signatures, Harmony actually also has access to other Kaspersky components?
It has access to the UDS (Urgent Detection System) which means they use the full sdk. They also use their feeds even if you choose to deploy with Sophos. Upon downloading files from any format, they will be looked up in ThreatCloud where Kaspersky and proprietary telemetry may contain the hash. On files already downloaded, executables reputation is checked in ThreatCloud.
None. they have two Kaspersky update servers. One from CP and the other from Kaspersky for redundancy. There is a delay with VT thou
So even if I choose Sophos, I'll be protected by Kaspersky?
You are protected by Kaspersky but Kaspersky feeds malicious hashes to ThreatCloud. Once the hash changes, it will not be detected anymore (until Kaspersky sees it and feeds the new hash). But then you have Sophos and NGAV. An attacker will need to escape from all that, plus the emulation.
Thanks guys for the explanation. I should really look more into Harmony... Even if I was a little sceptical it now seems like a well thought-through solution to me.
It's truely amazingThanks guys for the explanation. I should really look more into Harmony... Even if I was a little sceptical it now seems like a well thought-through solution to me.
Plus it's Israeli and has components of Russia and USA/UK. Alot of Intel.
- Status
You may also like...
-
-
-
-
Mystic Stealer Bypassing Sandboxes
- Started by Sandbox Breaker - DFIR
- Replies: 50
-
Trusted File is actually TA505 Threat Actor (Found by Human)
- Started by Sandbox Breaker - DFIR
- Replies: 8