Reply to thread

Message

<blockquote data-quote="imuade" data-source="post: 761056" data-attributes="member: 73949">Fortinet&#039;s documentation is pretty good, you can have a look at it:<a href="https://docs.fortinet.com/forticlient/admin-guides" target="_blank">https://docs.fortinet.com/forticlient/admin-guides</a><a href="https://docs.fortinet.com/d/forticlient-6.0.0-xml-reference" target="_blank">https://docs.fortinet.com/d/forticlient-6.0.0-xml-reference</a>A very useful under-the-hood setting is &lt;popup_registry_alerts&gt;0&lt;/popup_registry_alerts&gt;. If you set it to 1, FortiClient displays alerts if a process tries to change registry start items.Everyone here said FortiClient shouldn&#039;t be tested alone, but at least with SysHardened (if not with OSArmor). It would be nice if [USER=72251]@MoriartyOW[/USER] could make some tests with FC + SH (as [USER=51905]@Evjl&#039;s Rain[/USER] usually does with Avast).I think SH would have picked the missed samples of this test <a href="https://malwaretips.com/threads/30-08-2018-21.86368/" target="_blank">https://malwaretips.com/threads/30-08-2018-21.86368/</a> and the setting I wrote above should have prevented the items set on startup (you can see them in Autoruns and Process Explorer)</blockquote>

[QUOTE="imuade, post: 761056, member: 73949"] Fortinet's documentation is pretty good, you can have a look at it: [URL]https://docs.fortinet.com/forticlient/admin-guides[/URL] [URL]https://docs.fortinet.com/d/forticlient-6.0.0-xml-reference[/URL] A very useful under-the-hood setting is <popup_registry_alerts>0</popup_registry_alerts>. If you set it to 1, FortiClient displays alerts if a process tries to change registry start items. Everyone here said FortiClient shouldn't be tested alone, but at least with SysHardened (if not with OSArmor). It would be nice if [USER=72251]@MoriartyOW[/USER] could make some tests with FC + SH (as [USER=51905]@Evjl's Rain[/USER] usually does with Avast). I think SH would have picked the missed samples of this test [URL]https://malwaretips.com/threads/30-08-2018-21.86368/[/URL] and the setting I wrote above should have prevented the items set on startup (you can see them in Autoruns and Process Explorer) [/QUOTE]

Verification