Question KTS vs Scripts - ExecutionPolicy Unrestricted

[Studynxx]

Does KTS analyze scripts - powershell, python, batch - prior to letting them run if powershell executionpolicy is unrestricted? So the scripts don't need signing, you can run them with Run With Powershell but you'll get a warning prior to running them (as far as this executionpolicy is concerned)

 

[Bot]

Yes, Kaspersky Total Security (KTS) does analyze scripts for malicious behavior, regardless of the PowerShell execution policy. It provides proactive protection by scanning scripts before they are run. However, it's always recommended to use signed scripts and restrict PowerShell execution policy for an added layer of security.

 

[Xeno1234]

Does KTS analyze scripts - powershell, python, batch - prior to letting them run if powershell executionpolicy is unrestricted? So the scripts don't need signing, you can run them with Run With Powershell but you'll get a warning prior to running them (as far as this executionpolicy is concerned)

Yes. It has the best script protection of any antivirus.

 

[Shadowra]

Kaspersky analyzes the behavior of both malicious and non-malicious scripts.
A lot of malware uses scripts to download and launch payloads.

 

[Studynxx]

Kaspersky analyzes the behavior of both malicious and non-malicious scripts.
A lot of malware uses scripts to download and launch payloads.

So for example if I were to run a malicious script on my system then would it show me the same message of "blocking" as if it was, say, an .exe?Like "Malicious file blocked" or sth

 

[Shadowra]

So for example if I were to run a malicious script on my system then would it show me the same message of "blocking" as if it was, say, an .exe?Like "Malicious file blocked" or sth

Kaspersky uses a module called AMSI. First, it will attempt to block the connection to the server. If this doesn't work, the System Watcher will react with a behavioral detection (PDM:Trojan.Win32.Generic style).

 

[Studynxx]

Kaspersky uses a module called AMSI. First, it will attempt to block the connection to the server. If this doesn't work, the System Watcher will react with a behavioral detection (PDM:Trojan.Win32.Generic style).

OK but what if I were to deliberately create a malicious powershell script and run it on my system (VM) with Kaspersky on it? There would be no C2 server in this script btw

 

[Shadowra]

OK but what if I were to deliberately create a malicious powershell script and run it on my system (VM) with Kaspersky on it? There would be no C2 server in this script btw

If malicious behavior is known => Kaspersky rings
If nothing unusual => No reaction

 

[Studynxx]

If malicious behavior is known => Kaspersky rings
If nothing unusual => No reaction

Hm... Not sure I'm doing it correctly but I just wrote a simple powershell script that would attempt to write to system32 and as admin it wasn't blocked.