I don't understand the "Perform actions automatically" part

[Studynxx]

I followed Harlan's guide to put all apps that couldn't be categorized to High Restricted, as well as apps that start before KTS, also do not trust digitally signed apps

However, when I run some questionable exe from a torrent site in a VM as part of a test, they still run just fine. Why? I double checked and they ARE in the High Restricted group

 

[Bot]

"High Restricted" doesn't mean the apps are completely blocked. It means Kaspersky will monitor them closely for suspicious activities. If you want to completely block an application, you should move it to the "Untrusted" category.

 

[harlan4096]

I usually move unknown apps to Untrusted, not High Restricted, there is a difference, in Untrusted an app won't run but in High Restricted, still could run but with very low rights to perform its activities...

But lately I have the IP settings like this:

 

[harlan4096]

What says KSN about that questionable exe running in High Restricted? Show a picture of the info in the Intrusion Prevention, example:

 

[Studynxx]

"High Restricted" doesn't mean the apps are completely blocked. It means Kaspersky will monitor them closely for suspicious activities. If you want to completely block an application, you should move it to the "Untrusted" category.

So Kaspersky will first run the app or program in a sandbox and depending on its behavior (ie what registry changes does it try to make, what files does it try to read, what DNS records does it try to resolve, what IP addresses does it try to talk to, etc) it will either allow it to run or not? Since I have the "Perform actions automatically" ticked

What says KSN about that questionable exe running in High Restricted? Show a picture of the info in the Intrusion Prevention, example:

View attachment 282773

Mind you, this is NOT the official Macrium but a torrented version for the sake of testing KTS. Not a fan of pirating either, but as mentioned before, I'm testing KTS using these pirated things

 

[Studynxx]

"High Restricted" doesn't mean the apps are completely blocked. It means Kaspersky will monitor them closely for suspicious activities. If you want to completely block an application, you should move it to the "Untrusted" category.

Btw does KTS monitor apps in the High Restricted group much more closely, strictly than it does apps in the Low Restricted group?

 

[Bot]

So Kaspersky will first run the app or program in a sandbox and depending on its behavior (ie what registry changes does it try to make, what files does it try to read, what DNS records does it try to resolve, what IP addresses does it try to talk to, etc) it will either allow it to run or not? Since I have the "Perform actions automatically" ticked

Yes, Kaspersky analyzes the behavior of the app in a secure environment ("sandbox"). If the app shows suspicious behavior, Kaspersky takes appropriate action. With "Perform actions automatically" enabled, Kaspersky decides what action to take without asking you.

 

[Bot]

Btw does KTS monitor apps in the High Restricted group much more closely, strictly than it does apps in the Low Restricted group?

Yes, Kaspersky Total Security (KTS) monitors applications in the "High Restricted" group more closely than those in the "Low Restricted" group. The higher the restriction level, the more strict the monitoring is.

 

[harlan4096]

There is no sandbox pre-execution in Intrusion Prevention, it just follows the rules We have set, in my case: if unknown in KSN -> Untrusted, if issues in certificate -> Untrusted.

You can see this:

Why are You checking KTS? and not any of the new product line such as K. Standard or Plus?

 

[harlan4096]

If You want to check what is monitored (default rules/rights) in any of the groups, for example in High Restricted, just go to Intrusion Prevention -> Manage Applications, select High Restricted main line -> 1 right mouse click -> Details and Rules, check tabs: Files and System registry, Rights, Network rules.

Of course, We can change or add rules to those default ones of any group.

 

[Studynxx]

If You want to check what is monitored (default rules/rights) in any of the groups, for example in High Restricted, just go to Intrusion Prevention -> Manage Applications, select High Restricted main line -> 1 right mouse click -> Details and Rules, check tabs: Files and System registry, Rights, Network rules.

Of course, We can change or add rules to those default ones of any group.

Wait, wait, what I don't understand is how come if it's in High Restricted and I for example backup a folder and its files to another location, merely as a test so nothing actually worthy to me, it can still do that? I thought High Restricted barely had any read access, let alone write access... I left all of its privileges on default.

 

[harlan4096]

Those rules are applied in case that app is executed and its activities while running, but not when You copy or move it in the system.

 

[Studynxx]

Those rules are applied in case that app is executed and its activities while running, but not when You copy or move it in the system.

Wdym not when I copy or mvoe it in the system? I didn't change its default location, I just installed it

 

[Trident]

What Harlan is saying is these restrictions apply to the apps and processes that have been put in the relevant group. It does not apply to any actions you or other users perform in folders, as these actions are done via the trusted explorer.exe. To restrict other users from accessing, changing and deleting files, you will have to create user accounts for them and manage the folder permissions in explorer accordingly.

If some ransomware script or executable wants to access or change resources (folders) you’ve added as protected, this will be blocked.

Also, you can see restrictions as Harlan explained or by accessing this:

Controlling application activity on the computer and on the network

support.kaspersky.com

There is no sandboxing, ignore the bot.
Kaspersky uses dynamic emulator (like many other AVs if not all) to execute instructions of interest and monitor how the app behaves before you execute it.
This allows for more efficient detection of packers and obfuscated malware.
The higher the heuristic aggressiveness level, the more instructions are emulated, according to Kaspersky documentation.
Dynamic emulator is not related to Intrusion Detection.

 

[likeastar20]

What Harlan is saying is these restrictions apply to the apps and processes that have been put in the relevant group. It does not apply to any actions you or other users perform in folders, as these actions are done via the trusted explorer.exe. To restrict other users from accessing, changing and deleting files, you will have to create user accounts for them and manage the folder permissions in explorer accordingly.

If some ransomware script or executable wants to access or change resources (folders) you’ve added as protected, this will be blocked.

Also, you can see restrictions as Harlan explained or by accessing this:

Controlling application activity on the computer and on the network

support.kaspersky.com

There is no sandboxing, ignore the bot.
Kaspersky uses dynamic emulator (like many other AVs if not all) to execute instructions of interest and monitor how the app behaves before you execute it.
This allows for more efficient detection of packers and obfuscated malware.
The higher the heuristic aggressiveness level, the more instructions are emulated, according to Kaspersky documentation.
Dynamic emulator is not related to Intrusion Detection.

Can you link the documentation ?

 

[Trident]

Can you link the documentation ?

Advanced settings of File Anti-Virus window

support.kaspersky.com

It controls how many instructions will be emulated. The more aggressive level you choose, the more instructions will be emulated and the more likely it becomes that threat will be recognised.

 

[harlan4096]

Then only "sandbox" Kaspersky has now is for supported browsers in Safe Money sessions.

Many years ago, I recall, probably in 2011 , Kaspersky tried only during a while, a full desktop mode sandboxed, but it consumed too many resources, and was removed, so They only kept sandbox for browser.

Aaaah what times those were... nostalgia surrounds me:

Spoiler

Source

 

[likeastar20]

View attachment 282780

Advanced settings of File Anti-Virus window

support.kaspersky.com

It controls how many instructions will be emulated. The more aggressive level you choose, the more instructions will be emulated and the more likely it becomes that threat will be recognised.

Do you have any info on VHO? What exactly is VHO: ?

 

[Trident]

Do you have any info on VHO? What exactly is VHO: ?

To be honest I have no information. Bot called it Verifiable Heuristic Object, @harlan4096 says it means Very Harmful Object, another user has claimed it’s Vis Hash Online. To me it looks like you are right, most likely VHO is the equivalent of some cloud-verified heuristics, such as the McAfee JTI (Joint Threat Intelligence) that combines heuristics with Artemis reputation.
And like the Defender and Avast ML.

Can you put this file on another system, disconnect it from the web and check whether it will still be detected by Kaspersky?

 

[Practical Response]

To be honest I have no information. Bot called it Verifiable Heuristic Object, @harlan4096 says it means Very Harmful Object, another user has claimed it’s Vis Hash Online. To me it looks like you are right, most likely VHO is the equivalent of some cloud-verified heuristics, such as the McAfee JTI (Joint Threat Intelligence) that combines heuristics with Artemis reputation.
And like the Defender and Avast ML.

Can you put this file on another system, disconnect it from the web and check whether it will still be detected by Kaspersky?

It's part of the heuristic scans and is a detection category indicating a "very harmful object".