App Review Kaspersky Internet Security - System Watcher only, no KSN - ransomware test

[Evjl's Rain]

Great job man! Can you please do a test also on AVG software analyser?

yes I will test it for sure. I'm using avast and that will be implemented soon. I can't wait
But first I will test BD's ATC and norton's SONAR (online/offline)

 

[TheMalwareMaster]

yes I will test it for sure. I'm using avast and that will be implemented soon. I can't wait
But first I will test BD's ATC and norton's SONAR (online/offline)

If one wanted to test now Avast Cybercapture, there is no way of disabling the signatures and letting CyberCapture active, right?

 

[Evjl's Rain]

If one wanted to test now Avast Cybercapture, there is no way of disabling the signatures and letting CyberCapture active, right?

yes, it's true

 

[shmu26]

I applied a few things in this web
Protection against cryptoviruses in Kaspersky Internet Security
and something like this. Sorry I don't use Kaspersky anymore and I haven't tested these settings with legit applications, maybe it breaks legit apps also. This blocked all the ransomwares

please don't copy everything. Select the most important ones
maybe @Wave can suggest to us what to block in these screenshots

Spoiler: low restricted

View attachment 132877 View attachment 132878 View attachment 132879 View attachment 132880

will these tweaks stop scripts, or only exe files?
From what I understand, Application control only applies to exe files.
If you want to block scripts, you will also have to make block rules individually for each script interpreter.

 

[Wave]

will these tweaks stop scripts, or only exe files?
From what I understand, Application control only applies to exe files.
If you want to block scripts, you will also have to make block rules individually for each script interpreter.

It depends on the situation: is the executable running the script being restricted or not? If yes, then it'll apply to it too.

The script cannot just do things without using the Windows API, not possible. The script is interpreted and the contents of the script is used to determine the code for the execution of the actions, which then bonds down to using the Windows API -> NTAPI -> triggers any hooks from Kaspersky, kernel-mode callback notifications, and the such.

I believe Kaspersky work with MSR hooks with the hyper-visor on a system-wide level (virtualization but it allows them to bypass PatchGuard problems on x64 systems); they probably use user-mode hooking also with injection to the restricted programs, and device drivers for kernel-mode callbacks.

Enjoy the internals info, it should be right.

 

[Evjl's Rain]

will these tweaks stop scripts, or only exe files?
From what I understand, Application control only applies to exe files.
If you want to block scripts, you will also have to make block rules individually for each script interpreter.

hi, it controls scripts and.bat also. Basically everything you can click on to execute

 

[shmu26]

hi, it controls scripts and.bat also. Basically everything you can click on to execute
View attachment 132884

very cool, I didn't know. thanks!

@Wave, thanks for in-depth explanation, although it is a bit much for an amateur like myself. I am learning, but slowly...

 

[shmu26]

I applied a few things in this web
Protection against cryptoviruses in Kaspersky Internet Security
and something like this. Sorry I don't use Kaspersky anymore and I haven't tested these settings with legit applications, maybe it breaks legit apps also. This blocked all the ransomwares

please don't copy everything. Select the most important ones
maybe @Wave can suggest to us what to block in these screenshots

Spoiler: low restricted

View attachment 132877 View attachment 132878 View attachment 132879 View attachment 132880

there is a different approach, which solves the problem of your legit apps not working.
1 move all the apps you use to trusted
2 switch to interactive protection, in other words, untick "perform recommended actions automatically"
3 disable "trust digitally signed applications"
4 set trust level for unknown applications to "untrusted"

now you will get a prompt for every unknown that tries to run, like in a typical default/deny setup.

This method was mentioned by a user on this forum, I don't remember who it was, but it sounded very good to me

EDIT: but it has the disadvantage that recommended protections will not be applied, you will have to decide on your own when you see a prompt.

 

[ForgottenSeer 55778]

Great job! Better than Emsisoft even! Could you test G Data?

 

[ForgottenSeer 55778]

I heard it has better BB than Emsisoft too.

 

[Evjl's Rain]

Great job! Better than Emsisoft even! Could you test G Data?

I heard it has better BB than Emsisoft too.

hmm I don't believe it but I may quickly test it with a short video

 

[ForgottenSeer 55778]

Thanks!

 

[Wave]

I heard it has better BB than Emsisoft too.

They both work completely differently, you can't just compare the two. Kaspersky System Watcher works differently.

For example, Kaspersky have trust levels with rule sets for each trust level (restriction levels), and the rule sets support a lot of things. Whereas, Emsisoft have a cloud network for allowing through trusted objects only, and then perform monitoring to identify specific threat behavior or prevent specific activity occurring, as opposed to taking the trust restriction route.

 

[toto]

Great job

 

[erreale]

They both work completely differently, you can't just compare the two. Kaspersky System Watcher works differently.

For example, Kaspersky have trust levels with rule sets for each trust level (restriction levels), and the rule sets support a lot of things. Whereas, Emsisoft have a cloud network for allowing through trusted objects only, and then perform monitoring to identify specific threat behavior or prevent specific activity occurring, as opposed to taking the trust restriction route.

Great explanation

 

[Solarquest]

Unless Emsisoft changed this in the latest versions, Emsi checks the cloud after BB detected something suspicions enough; unfortunately it's not the other way round (first cloud check for all files, than BB monitors the leftover files).
Behaviour blocker -Anti-malware Network