App Review Kaspersky Security Cloud Free vs Ransominator (default settings)

[Evjl's Rain]

As far as I know Kaspersky 2021 won't have TAM anymore.

yes, fortunately, we can still make Kaspersky perform like TAM by changing 2 options in Application Control. Harlan showed it here. I can confirm it. It works exactly the same. Even with faster speed.

App Review - Avast Free (Hardened Mode) vs Ransominator

And it can be mimicked with the existing Application Control by setting unknown applications to 'Untrusted' There is anyway to create a rule for that or do i need to set unknown applications as 'Untrusted' individually. I couldn't find any way to create a rule that could set all unknow apps as...

malwaretips.com

 

[fabiobr]

Thanks to application control custom rules, document files were protected in my test.

Advanced disinfection starts, restart the system and all things rolled back.

Cloud Detection:

View attachment 238190

@geminis3 Did you send the sample manually or it detected automatically?

 

[bayasdev]

@geminis3 Did you sent the sample annually or it detected automatically?

I inmediately rolled back the VM after recording so I guess they automatically upload every unknown exe to their cloud.

 

[MacDefender]

FWIW I just tried my TrojanZipperPOC against KTS2020 this morning.

KTS dynamically detected it as "PDM:Trojan.Win32.Generic", offered to disinfect and reboot. Unfortunately, in that process, it did not trigger a System Watcher Rollback. This process left about a third of the files encrypted but it stopped the rest. Overall an okay result. I believe this is still the same behavior that was previously seen when this test was done.

 

[fabiobr]

I inmediately rolled back the VM after recording so I guess they automatically upload every unknown exe to their cloud.

Did you learn how Kaspersky works, @NSA/CIA?

 

[miguelang611]

Thanks to application control custom rules, document files were protected in my test.

Advanced disinfection starts, restart the system and all things rolled back.

Cloud Detection:

View attachment 238190

Hi!
Thanks for the info. May I knowh what are you settings for app control custom rules?
Sorry, if they're somewhere else, I didn't see them.
Personally I have a custom rule as harlan4096 suggest: whole C:\* with maximum restriction, just read allowed, just charges the KSN rules, doesn't allow if not known on KSN but digitally signed. Do you go even further?
Thanks!

 

[fabiobr]

Hi!
Thanks for the info. May I knowh what are you settings for app control custom rules?
Sorry, if they're somewhere else, I didn't see them.
Personally I have a custom rule as harlan4096 suggest: whole C:\* with maximum restriction, just read allowed, just charges the KSN rules, doesn't allow if not known on KSN but digitally signed. Do you go even further?
Thanks!

The same, but only protect my important folders, not all C:\

 

[miguelang611]

The same, but only protect my important folders, not all C:\

Thank u for the info!
Your important folders means just Desktop, Documents and so on... Or also AppData for example?
Cheers!

 

[fabiobr]

Thank u for the info!
Your important folders means just Desktop, Documents and so on... Or also AppData for example?
Cheers!

OneDrive, Documents, Images and Creative Cloud, can't lose my work files.

 

[miguelang611]

OneDrive, Documents, Images and Creative Cloud, can't lose my work files.

Interesting, appart from C:\ restriction to write and modify for high restricted, I added Documents as igh restricted can't even read them, as a privacy matter.
Thank u for the idea!

 

[MacDefender]

Thanks to application control custom rules, document files were protected in my test.

Advanced disinfection starts, restart the system and all things rolled back.

Cloud Detection:

View attachment 238190

After getting several of my samples blocked by KSN across my test and development machines, I did a bit of searching and found this:

Protection From A Cloud — What Is Kaspersky Security Network

The Internet allows malware to spread with lightning speed. We made our software capable of protecting you with the same impressive speed. See how it works.

www.kaspersky.com

UDS = Urgent Detection System -- roughly put, if the behavior blocker finds suspicious behavior in an unknown binary, that gets reported back up to the cloud and it immediately results in a cloud signature blocking this for other clients too.

This leads to interesting behavior like when I try to test a custom-built malware sample in a VM and it triggers Kaspersky, often times it also results in my host development machine's Kaspersky removing the .EXE from the Build directory as well.

SONAR claims to do the same thing but I've never seen it react as quickly as KSN -- this is like 5 minutes from triggering KSW to having the EXE be blocked by other machines running Kaspersky on my network. As Kaspersky says:

Less than a minute after first threat detection, all KSN-connected computers are protected from it.

 

[MacDefender]

Case in point, here's a Emotet sample I saw on CAPE about a few hours ago: VirusTotal

At the time it had no detection in Kaspersky. But now, it's being detected by Kaspersky engines as "UDS:DangerousObject.Multi.Generic"

ESET hasn't even added signatures for it yet!