I installed both OSArmor and ReHIPS (Expert mode). Next, I ran several times the script :
Code:
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run("C:\Users\Public\Downloads\payload.exe")
WScript.Quit
.
The payload.exe , can be any
not-signed executable.
The result on my machine (Windows 10 FCU 64-Bit) was always the same: ReHIPS was triggered first (every time) and OSArmor second. I had to press first 'allow' in ReHIPS to see the OSArmor alert. Sometimes OSArmor was not triggered at all.
I even installed OSArmor first and ReHIPS second, to be sure that the order of installation does not matter.
Next, I disabled ReHIPS protection and installed NVTERP 3.1.0.0. with option 'Do not check if a process is signed (save bandwidth)'. I repeated the test, and now OSArmor and NVTERP blocked execution from the script at the same moment (2 alerts visible).
So, ReHIPS block feature works differently from NVT products, and can block execution at the earlier stage.
In the end, I installed Sandboxie (forced to sandbox the payload.exe) and repeated the test. ReHIPS was triggered first, Sandboxie second and OSArmor was never triggered (payload.exe was sandboxed). But, OSArmor could miss blocking execution from the script. So, I tested another OSArmor feature:
'Block execution of unsigned processes on Local AppData'. I also set Sandboxie to block payload.exe because OSArmor can also block programs in the Sandboxie Sandbox. The result was always the same Sandboxie blocked execution and no alert from OSArmor. When I allowed running payload.exe in Sandboxie sandbox, then OSArmor immediately blocked it showing the alert.
So, my conclusion is that on my machine (the most left is triggered first):
SmartScreen > ReHIPS > Sandboxie > OSArmor
I did not test other OSArmor features, so I cannot say for sure that the above is true for all OSArmor features.
.
Edit
The post was several times edited, because of the complex interactions between Sandboxie and OSArmor. I thought that OSArmor can be triggered first and Sandboxie second, because OSArmor blocked execution of payload.exe in the sandbox so quickly, that sandboxing were not visible. I realized that this can be a problem and changed Sandboxie settings to block payload.exe and then everything was finally clear to me.
