New Update Introducing Comodo Internet Security 2027 V12.4.0.8170

[Divine_Barakah]

Yes

But when malicious activity takes place, doesn't Comodo hips alert of that suspicious/malicious activity?

 

[vitao]

Still, you don't need to escape the containment, DLL hijacking Is All You Need.
View attachment 299022

hello my love! can you send it for me on telegram? i just tested it with the old v4 and cis blocked it

 

[vitao]

Hey everyone, I hosted a nearly 4-hour livestream to showcase the new version of CIS, find out if anything changed beyond the name and terms like HIPS and EDR, and put CIS to the test against 299 malware samples—ranging from zero-days to "one-day" exploits.

Here are the tests and results:

1) CIS updates + CIS 2027 vs. the old exploit: CIS had been updated and protected against the PoC, even with all its modules disabled except for Auto-Containment (I mean *all* of them, even script analysis);

2) CIS 2027 vs. 299 malware samples (without Auto-Containment or Cloud Analysis): Its AV identified just over 100 samples, while the rest fluctuated between execution and offline identification;

3) CIS 2027 vs. the same 299 malware samples (without the antivirus module, but with Auto-Containment + Firewall + WebLookUp): 298 samples were isolated by Auto-Containment and 1 executed; however, when I uploaded that file to VirusTotal, no engines detected a threat. I ran some checks, and it appears the file is either legitimate, an incomplete malware sample (the type that needs to download a payload but fails to complete that step, even without CIS), or simply a corrupted/incomplete file.

Now, I'm just waiting to see if Loyiza will be kind enough to send me her new PoC/exploit so I can test it in a future livestream against the new CIS 2027

Livestream link: (In pt-BR only. I don´t know if Youtube already made the automatic subs for this live)

 

[Andy Ful]

But as far as I understand, sandboxing won't help against data theft?

But in CIS, it helps. There is an option to block connections for sandboxed files.

 

[Andy Ful]

Still, you don't need to escape the containment, DLL hijacking Is All You Need.

Hi Loyisa,

Some users did not believe that there is malware in the wild that can bypass CIS auto-containment via DLL hijacking, so I created a special thread.
Those examples are interesting:

App Review Post in thread 'Comodo Internet Security vs targeted ransomware attack.'

Tuesday at 10:30 AM

It is very hard to find an in-the-wild attack that could bypass Comodo. Probably impossible against home users.
However, here is a recent example (targeted attack on government entities) that uses twice the method presented in my video:

The EXE files are benign/legitimate, so most AVs can also fail to detect the attack (as 0-day).
One of the used DLLs is still undetected by such strong AVs as Bitdefender...

• Andy Ful

• 
• 
• 

App Review Post in thread 'Comodo Internet Security vs targeted ransomware attack.'

Mar 3, 2026

Here is a similar example in the wild (InfoStealer), although it also uses shell code. It would be interesting to test it against Comodo to see how strong Comodo's shell code injection protection is.
https://thehackernews.com/2026/03/sloppylemming-targets-pakistan-and.html?m=1
https://malwaretips.com/threads/slo...using-dual-malware-chains.140014/post-1173685

There is a difference compared to my video. In the case of video, the targets were machines with Comodo protection. The in-the-wild example had probably a...

• Andy Ful

• 
• 

However, all known examples so far are POCs or highly targeted malware.

 

[Andy Ful]

So in this case the DLL was not auto contained?

Comodo cannot contain DLLs loaded by Trusted processes. Only Xcitium has an option to do it.
As for a home product, allowing such DLLs is understandable because it would trigger many false positives.
Smart App Control can do it, and we know how many false positives can happen. Many signed applications use unsigned DLLs.

 

[Parkinsond]

Comodo cannot contain DLLs loaded by Trusted processes. Only Xcitium has an option to do it.
As for a home product, allowing such DLLs is understandable because it would trigger many false positives.
Smart App Control can do it, and we know how many false positives can happen. Many signed applications use unsigned DLLs.

and even excluding the whole folder in WHHL did not stop WDAC from blocking Vulkan.dll of Yandex browser according to events log.

 

[Sephirothnight]

Hi, Like the previous version, everything that goes through the sandbox doesn't connect, which limits its usefulness because we can no longer launch our browsers in a Comodo sandbox (so we go back to the Windows sandbox). It's a shame about that, but otherwise it's good. Now we'll have to see how it holds up over time.

 

[Halp2001]

Hi, Like the previous version, everything that goes through the sandbox doesn't connect, which limits its usefulness because we can no longer launch our browsers in a Comodo sandbox (so we go back to the Windows sandbox). It's a shame about that, but otherwise it's good. Now we'll have to see how it holds up over time.

New Update Post in thread 'New Version 12.3.3.8152 Available for Comodo Internet Security 2025'

Dec 27, 2024

Workaround found by any more experienced person. In the HIPS Settings (even if you have disabled) you need to remove "Windows Sockets Interface" from Protected Files. You'll then be able to allow internet connection with sandboxed browsers. I don't run browsers sandboxed myself so leaving it there at my end.

Spoiler: HIPS >>Protected Files >>Windows Sockets Interface

• ErzCrz

• 
• 

 

[Andy Ful]

New Update Post in thread 'New Version 12.3.3.8152 Available for Comodo Internet Security 2025'

Dec 27, 2024

Workaround found by any more experienced person. In the HIPS Settings (even if you have disabled) you need to remove "Windows Sockets Interface" from Protected Files. You'll then be able to allow internet connection with sandboxed browsers. I don't run browsers sandboxed myself so leaving it there at my end.

Spoiler: HIPS >>Protected Files >>Windows Sockets Interface

• ErzCrz

• 
• 

It is worth mentioning that this solution allows contained malware to use network services.

 

[Loyisa]

But when malicious activity takes place, doesn't Comodo hips alert of that suspicious/malicious activity?

Although Comodo's help(http://help.comodo.com/topic-72-1-766-9163-HIPS-Settings.html) states:

• Safe Mode: While monitoring critical system activity, HIPS automatically learns the activity of executables and applications certified as 'Safe' by Comodo. It also automatically creates 'Allow' rules for these activities, if the checkbox 'Create rules for safe applications' is selected. For non-certified, unknown, applications, you will receive an alert whenever that application attempts to run. Should you choose, you can add that new application to the HIPS rules list by choosing 'Treat as' and selecting 'Allowed Application' at the alert with 'Remember my answer' checked. This instructs the HIPS not to generate an alert the next time it runs. If your machine is not new or known to be free of malware and other threats then 'Safe Mode' is recommended setting for most users - combining the highest levels of security with an easy-to-manage number of HIPS alerts.

However, HIPS in Safe Mode will allow all activities of trusted processes(even it loaded malicious DLL)

 

[ErzCrz]

It is worth mentioning that this solution allows contained malware to use network services.

Agreed but the only immediate workaround I could find though I think you can refine the rule or create a specific hips/edr rule for a browser but as I don't want anything in sandbox to connect out, I leave it as is. Not done any testing with the new version on this front.

 

[New_Style_xd]

It's not normal for it to show that value; it's all in the Windows Registry—I'll show it in the image below.

I can't show every detail, but the process at the top of the list—the one that's fully expanded—is a Windows process. It's really bizarre... I wonder if it's a bug?