Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 624056" data-attributes="member: 32260">Summing up the PowerShell security in Comodo Firewall, we have:<ol>
<li data-xf-list-type="ol">Comodo Sandbox with [USER=7463]@cruelsister[/USER] settings, when keeping powershell.exe and powershell_ise.exe as Unrecognized.</li>
<li data-xf-list-type="ol">&quot;Heuristic Command Line Analysis&quot; and &quot;Embedded Code Detection&quot;, integrated under one interface as &quot;Do Heurristic Command Line Analysis&quot;.</li>
</ol>The &#039;Embeded Code Detection&#039; catches fileless scripts, converts them into files in the: C:\ProgramData\Comodo\Cis\tempscrptfolder,&nbsp; and finally throws into the sandbox. This fucntion + heuristics has to be quite efficient in script blocking.&nbsp; People on Comodo forum complain, that their scripts (Visual Studio project assemblies) are autosandboxed, when &quot;Do Heurristic Command Line Analysis&quot; is activated. If one wants to run embedded scripts, he can activate the HIPS, and give the script hosting executable, the Installer/Updater policy.So, for home users, CF offers very good PowerShell security.</blockquote>

[QUOTE="Andy Ful, post: 624056, member: 32260"] Summing up the PowerShell security in Comodo Firewall, we have: [LIST=1] [*]Comodo Sandbox with [USER=7463]@cruelsister[/USER] settings, when keeping powershell.exe and powershell_ise.exe as Unrecognized. [*]"Heuristic Command Line Analysis" and "Embedded Code Detection", integrated under one interface as "Do Heurristic Command Line Analysis". [/LIST] The 'Embeded Code Detection' catches fileless scripts, converts them into files in the: [I]C:\ProgramData\Comodo\Cis\tempscrpt[/I] folder[I],[/I] and finally throws into the sandbox. This fucntion + heuristics has to be quite efficient in script blocking. People on Comodo forum complain, that their scripts (Visual Studio project assemblies) are autosandboxed, when "Do Heurristic Command Line Analysis" is activated. If one wants to run embedded scripts, he can activate the HIPS, and give the script hosting executable, the Installer/Updater policy. [B]So, for home users, CF offers very good PowerShell security.[/B] [/QUOTE]

Verification