Serious Discussion Harmony Endpoint by Check Point

[NormanF]

The extension is intended for admins to make sure only trusted content is being downloaded. You can’t expect workers to be experts. If anyone knows better then they can decide to turn it off.

@Shadowra How long does Symantec Endpoint Protection run after installation?

The unmanaged SEP will run indefinitely. If you need to manage it, you need a license for the term its sold.

 

[Trident]

The unmanaged SEP will run indefinitely. If you need to manage it, you need a license for the term its sold.

The unmanaged SEP has very little benefit over Norton though and is definitely not better than Harmony. Only SEP Complete can be compared to Harmony. Not sure how the prices are nowadays.
And if you want emulation, additional license is required for Symantec Cynic (never tried it myself although I would love to).

 

[Shadowra]

I was complaining about DeepInstinct's false positives, but Harmony is WORSE!
In fact, its reputation system literally deleted several files and programs without a hitch...

A few .RAR files were deleted (nothing personal, I assure you).
It completely deleted Neat Download Manager, IObit DriverBooster (it's not the only one) and even 3 .EXE files from GigaByte Aorus!

If you're going to install it, be sure to make exclusions.

 

[Trident]

Riskware treatment is actually disabled by default, it’s my policy that enables it. Various tuneup utilities, torrent downloaders and driver updaters will be classified as riskware, not only from IOBit.

 

[NormanF]

I was complaining about DeepInstinct's false positives, but Harmony is WORSE!
In fact, its reputation system literally deleted several files and programs without a hitch...

A few .RAR files were deleted (nothing personal, I assure you).
It completely deleted Neat Download Manager, IObit DriverBooster (it's not the only one) and even 3 .EXE files from GigaByte Aorus!

If you're going to install it, be sure to make exclusions.

When I trialed it, it removed Process Hacker and quarantined it as malware when I tried to download it. I hate software that tries to protect me for my own good. I should be the one to make the call if something is harmful or not. I will never allow security software to overrule human judgment.

 

[Shadowra]

When I trialed it, it removed Process Hacker and quarantined it as malware when I tried to download it. I hate software that tries to protect me for my own good. I should be the one to make the call if something is harmful or not. I will never allow security software to overrule human judgment.

ProcessHacker several antivirus programs detect it as risky software...
I was even surprised that Bitdefender removed KillSwitch from COMODO....

 

[Trident]

ProcessHacker several antivirus programs detect it as risky software...
I was even surprised that Bitdefender removed KillSwitch from COMODO....

They detect it because it can be abused. The PUP detection in Harmony is very strong so yeah. Either admins should create exclusions by folder or riskware treatment should be disabled. I personally keep it enabled for maximum security.
Check Point for many years haven’t been fans of snake oil software.

 

[NormanF]

ProcessHacker several antivirus programs detect it as risky software...
I was even surprised that Bitdefender removed KillSwitch from COMODO....

To be fair its not been updated for ages and what happens with it and KillSwitch is the developers don't bother addressing the signatures to eliminate FPs detection.

 

[Shadowra]

They detect it because it can be abused. The PUP detection in Harmony is very strong so yeah. Either admins should create exclusions by folder or riskware treatment should be disabled. I personally keep it enabled for maximum security.
Check Point for many years haven’t been fans of snake oil software.

The problem is that Neat doesn't have any PUPs or the like... Harmony even classifies it as a Trojan!

 

[Trident]

The problem is that Neat doesn't have any PUPs or the like... Harmony even classifies it as a Trojan!

View attachment 276995

Is it Neat the accounting software?

The Neat Company: Smarter receipt and document management

Transform the way you manage and organize your home or business. Unlimited file and document storage, expense tracking, bank-level encryption, and more! Try for free.

www.neat.com

 

[Shadowra]

For TuneUP, Che

Is it Neat the accounting software?

The Neat Company: Smarter receipt and document management

Transform the way you manage and organize your home or business. Unlimited file and document storage, expense tracking, bank-level encryption, and more! Try for free.

www.neat.com

No, here Neat Download Manager for Mac and Windows (Free Internet Download Manager Mac & Windows )

 

[Trident]

No, here Neat Download Manager for Mac and Windows (Free Internet Download Manager Mac & Windows )

That one is being detected by CrowdStrike as well. Maybe at one point it was exhibiting some adware behaviour.

https://www.hybrid-analysis.com/sample/9b1312a336393e511e2e741fd03b2b6992f365c24d1b15ab7eb35f5297e90651/5d9a7997028838e528fe39d7

 

[Kongo]

No, here Neat Download Manager for Mac and Windows (Free Internet Download Manager Mac & Windows )

I mean it's detected by 12 engines on VT.

 

[likeastar20]

That one is being detected by CrowdStrike as well. Maybe at one point it was exhibiting some adware behaviour.

https://www.hybrid-analysis.com/sample/9b1312a336393e511e2e741fd03b2b6992f365c24d1b15ab7eb35f5297e90651/5d9a7997028838e528fe39d7

CS tends to say malware too often

 

[Kongo]

CS tends to say malware too often

Happens with many AI based products unfortunately

 

[Xeno1234]

One of the detections (gen.win.processhollowing) seems to be a generic detection for code injection via process hollowing (run process -> pause process -> replace portion of process memory with malicious code -> resume process). Seeing a process hollowing detection by behavioural blocking is quite unusual, many AVs are totally blind to that. Some can catch initial scripts early by using local emulator in memory but the emulator doesn’t have all day, it’s only got milliseconds and by using a JS with useless math operations and malicious actions somewhere in the middle, local emulator can easily be bypassed (unlike full blown emulation in the cloud that has the time).

This is why it has become attackers favourite. Quite a lot of malware can be blocked by this detection.

So when Check Point was saying that fileless malware is not a problem for behavioural guard, they’ve not been joking.

https://blog.checkpoint.com/security/file-less-malware-no-match-for-sandblast-agent/amp/

I've started to use Checkpoint and I'm definetally impressed by its detection capabilities, both from my usage of testing it and also seeing these tests. It's truely a great product.

On a RedLine FUD
Not even ESET knew about it when I tested...
Harmony shocked me...

Spoiler: Harmony

View attachment 276986
View attachment 276987
View attachment 276988
View attachment 276989
View attachment 276990
View attachment 276991

How does Harmony face with Backdoors/RATS - Anti-Viruses I feel struggle at detecting those.

 

[Shadowra]

How does Harmony face with Backdoors/RATS - Anti-Viruses I feel struggle at detecting those.

To bypass Harmony, you must not be detected by Kaspersky/Sophos in AV, not be known by Kaspersky Cloud feeds, CheckPoint NGAV and above all by emulation.

I've never managed to bypass it at the moment.

 

[Xeno1234]

To bypass Harmony, you must not be detected by Kaspersky/Sophos in AV, not be known by Kaspersky Cloud feeds, CheckPoint NGAV and above all by emulation.

I've never managed to bypass it at the moment.

Whats the NGAV - is that the Anti-Malware component or its own seperate Anti-Virus?

 

[Trident]

To bypass Harmony, you must not be detected by Kaspersky/Sophos in AV, not be known by Kaspersky Cloud feeds, CheckPoint NGAV and above all by emulation.

I've never managed to bypass it at the moment.

It also must not look in any way suspicious to behavioural guard and must not contact any known C&Cs as Harmony, just like Kaspersky, considers connections to malicious sites as the ultimate sin and initiates removal very quick. Also, if businesses use Harmony Email (as most threats on businesses arrive through email), the email must not in any way look like SPAM (which is extremely difficult, so far I haven’t been able to bypass Harmony Email).

Whats the NGAV - is that the Anti-Malware component or its own?

Yes, it is. By default it works on medium aggressivness as opposed to ZoneAlarm where it is not aggressive. Also, it is possible to ask support to enroll you into early availability models for NGAV and behavioural guard.

 

[Xeno1234]

It also must not look in any way suspicious to behavioural guard and must not contact any known C&Cs as Harmony, just like Kaspersky, considers connections to malicious sites as the ultimate sin and initiates removal very quick. Also, if businesses use Harmony Email (as most threats on businesses arrive through email), the email must not in any way look like SPAM (which is extremely difficult, so far I haven’t been able to bypass Harmony Email).

Yes, it is. By default it works on medium aggressivness as opposed to ZoneAlarm where it is not aggressive. Also, it is possible to ask support to enroll you into early availability models for NGAV and behavioural guard.

So it is its own AV? Sorry to ask again but you said "Yes" to a "or" question.