Reply to thread

Message

<blockquote data-quote="rndmblk" data-source="post: 922375" data-attributes="member: 89746">I followed the steps you outlined previously (<a href="https://malwaretips.com/threads/kasperskys-application-control-what-is-it-how-it-works.95402/post-922373" target="_blank">Kaspersky&#039;s Application Control: what is it, how it works</a>)I unticked the &#039;trust digitally signed applications&#039; box but left &#039;load rules for applications from KSN&#039; as ticked. I then started up the main applications that I use. In my case they all started up without issue and connected to the internet. When I click Manage Applications I see that they have been added as Trusted applications.My understanding is that applications get added as Trusted if they match a KSN rule and if they don&#039;t match a KSN rule they won&#039;t run (as I set unknown apps to untrusted). Is it correct to say that this App Control wouldn&#039;t stop the app from running if it was modified? if an undetected piece of malware changed the contents of abc.exe because abc.exe as an application is trusted it would still launch? i.e. it&#039;s not matching against &#039;known good&#039; copies of the files?</blockquote>

[QUOTE="rndmblk, post: 922375, member: 89746"] I followed the steps you outlined previously ([URL="https://malwaretips.com/threads/kasperskys-application-control-what-is-it-how-it-works.95402/post-922373"]Kaspersky's Application Control: what is it, how it works[/URL]) I unticked the 'trust digitally signed applications' box but left 'load rules for applications from KSN' as ticked. I then started up the main applications that I use. In my case they all started up without issue and connected to the internet. When I click Manage Applications I see that they have been added as Trusted applications. My understanding is that applications get added as Trusted if they match a KSN rule and if they don't match a KSN rule they won't run (as I set unknown apps to untrusted). Is it correct to say that this App Control wouldn't stop the app from running if it was modified? if an undetected piece of malware changed the contents of abc.exe because abc.exe as an application is trusted it would still launch? i.e. it's not matching against 'known good' copies of the files? [/QUOTE]

Verification