Question I downloaded something, it said it was untrusted by KSN, but I scanned it and kaspersky said no threats.

[Xeno1234]

I downloaded something, it said it was untrusted by KSN, but I scanned it and kaspersky said no threats.
I then ran it, and HIPS picked it up UDS:blablabla.
Is this a normal thing?
(If your wondering why I ran it, I have a default deny setup, its not gonna be able to start)

 

[Bot]

Yes, it is possible for KSN to flag a file as untrusted even if no threats are detected during a scan. The HIPS (Host Intrusion Prevention System) may pick up suspicious activity during the execution of the file, resulting in it being flagged as a potential threat. It is important to always be cautious when downloading and running files, even if they appear to be safe based on a scan.

 

[harlan4096]

I downloaded something, it said it was untrusted by KSN, but I scanned it and kaspersky said no threats.
I then ran it, and HIPS picked it up UDS:blablabla.
Is this a normal thing?
(If your wondering why I ran it, I have a default deny setup, its not gonna be able to start)

Yes, that is completely normal behavior

Even, if You are in default settings, if an exe file is already tagged as untrusted by KSN, it will be picked and its execution will be blocked.

The detection is usually UDS: Urgent Detection System

 

[Zorro]

No need to run unknown files downloaded from questionable sites. And if you downloaded it, then check it not with an antivirus, but with a Virustotal.

 

[Shadowra]

Yes, that is completely normal behavior

Even, if You are in default settings, if an exe file is already tagged as untrusted by KSN, it will be picked and its execution will be blocked.

The detection is usually UDS: Urgent Detection System

Can Kaspersky detect UDS after execution? Oo
I've always seen detections in PDM:Trojan.Win32.Generic on my side.

 

[harlan4096]

No need to run unknown files downloaded from questionable sites. And if you downloaded it, then check it not with an antivirus, but with a Virustotal.

Or inside a virtual machine system.

Update: this reply was related to @Zorro one

 

[harlan4096]

Can Kaspersky detect UDS after execution? Oo
I've always seen detections in PDM:Trojan.Win32.Generic on my side.

PDM detections (Proactive Defense Module) are on execution, UDS are those usually from KSN already tagged as untrusted, so even if no detection on demand, if You execute that untrusted tagged files, They will be blocked and will get that UDS detection.

 

[Zorro]

Or inside a virtual machine system.

Update: this reply was related to @Zorro one

Or at least in a sandbox program.

 

[likeastar20]

I downloaded something, it said it was untrusted by KSN, but I scanned it and kaspersky said no threats.
I then ran it, and HIPS picked it up UDS:blablabla.
Is this a normal thing?
(If your wondering why I ran it, I have a default deny setup, its not gonna be able to start)

What was the file ? VT LINK?