Xeno1234
Level 14
- Jun 12, 2023
- 684
Harmony uses Kaspersky's engine for everything by default right, or is it sophos?
Evasive VBS with very low VT
- Thread starter Sandbox Breaker
- Start date
- Status
- Mar 16, 2019
- 3,867
This is ESET Endpoint trial version.Since when does LiveGuard have such an UI?
PDM is System Watcher.
- Jan 6, 2022
- 530
Yes it is, you will only see the PDM prefix for System Watcher detections.
"The proactive defense module is a module that monitors the sequence of actions conducted by an application in the system, and if suspicious activity is detected, the application is blocked to prevent it from conducting further activity. If an object is detected by the PDM, the name of the object begins with the “PDM:” prefix." It was likely renamed to System Watcher at some point, they just just stuck with the PDM prefix for detections.
Last edited:
- Jan 6, 2022
- 530
About System Watcher
support.kaspersky.com
BSS is not a prefix they use for detections, when an item is detected by System Watcher it will always begin with "PDM:". BSS is how System Watcher works, and not a detection prefix.BSS would be system watcher. Behavioural Stream SignaturesmAbout System Watcher
- Jan 6, 2022
- 530
Who cares lol. At least they block it at many layers.
This also means Check Point Harmony has system watcher.
Last edited by a moderator:
- Feb 25, 2017
- 2,597
Doesn't that mean that Kaspersky added a signature after it was detected by System Watcher? And the signature however is available for Harmony as it's using the Kaspersky engine and therefor its signatures? I doubt that it can dynamically analyze malware with Kaspersky's behavioural and AI components.
Last edited by a moderator:
- Jan 6, 2022
- 530
The PDM module runs locally. I've seen these seen these detections locally in Harmony before.
- Feb 7, 2023
- 2,349
PDM can be seen in @Shadowra's test here so it is in Harmony. I am using it with Sophos, hence it reached the behavioural guard layer, where it was instantly annihilated. PDM is probably system watcher's telemetry based. Kaspersky has multiple signatures that can detect the threat.
- Jan 6, 2022
- 530
Yes sir.
Harmony is the best value and so superior. I'm also using their mobile solutions. Cloud sandboxes are included with harmony Mobile.
- Feb 25, 2017
- 2,597
So there is absolutely no delay in Kaspersky detections and Harmony with Kaspersky engine? And while all AVs with Bitdefender engine only get its signatures, Harmony actually also has access to other Kaspersky components?
- Feb 7, 2023
- 2,349
It has access to the UDS (Urgent Detection System) which means they use the full sdk. They also use their feeds even if you choose to deploy with Sophos. Upon downloading files from any format, they will be looked up in ThreatCloud where Kaspersky and proprietary telemetry may contain the hash. On files already downloaded, executables reputation is checked in ThreatCloud.
- Jan 6, 2022
- 530
None. they have two Kaspersky update servers. One from CP and the other from Kaspersky for redundancy. There is a delay with VT thou
- Sep 2, 2021
- 2,630
So even if I choose Sophos, I'll be protected by Kaspersky?
- Jan 6, 2022
- 530
- Feb 7, 2023
- 2,349
You are protected by Kaspersky but Kaspersky feeds malicious hashes to ThreatCloud. Once the hash changes, it will not be detected anymore (until Kaspersky sees it and feeds the new hash). But then you have Sophos and NGAV. An attacker will need to escape from all that, plus the emulation.
- Feb 25, 2017
- 2,597
Thanks guys for the explanation. I should really look more into Harmony... Even if I was a little sceptical it now seems like a well thought-through solution to me.
- Jan 6, 2022
- 530
It's truely amazingThanks guys for the explanation. I should really look more into Harmony... Even if I was a little sceptical it now seems like a well thought-through solution to me.
Plus it's Israeli and has components of Russia and USA/UK. Alot of Intel.
- Status
Similar threads
