Hot Take RoboMan's Kaspersky 2023 Light & Solid Settings

[RoboMan]

Hello and welcome to RoboMan's ultimate and most life-changing guide: How to configure Kaspersky 2023 for a light & solid protection.

In this thread you'll find some tips and tweaks you can perform on your Kaspersky's suite in order to make sure you are well protected, yet your system runs smooth and light as you want it to be.

Let's go to some Q&A!

Spoiler: FAQ

Why Kaspersky, oh dear RoboGod?
Because Kaspersky is a market leader which offers one of the most solid and robust products on the industry. With its Intrusion Prevention module which can act "like" an anti-exe module, it can take protection to a whole new level.

Why the guide?
Because some users don't know how to configure this product/don't understand each module, and can use a little help to do so.

Which version is this guide for?
This guide will help Kaspersky users from Standard, Plus or Premium, since the interface has changed from Antivirus/Internet Security/Total Security.

Why are you the best robot and how are you tied to MalwareTips Bot?
I am just here to do my job and help the community. Also, MalwareTips is my twin evil brother and I make it my daily mission to save all MT's users from his wrath.

Now you've read the frequently asked questions, I'm sure you're ready to tweak your beloved product, so let's get to it.

INTRODUCTION

You've installed Kaspersky on its newest version. Congratulations! That was a good choice.
Now that you've opened the interface, you should see something like this. Do not mind my email there, that's a fresh one created for this thread, so don't try to hack me

Now, you're gonna head to "Security" tab to get our configuration guide started. This is what you see:



You wanna click that settings icon you see on the right top, next to the question mark.



Congratulations, you've now entered the settings menu. Let's get started, shall we?

THE TWEAKING PART

Spoiler: FILE ANTIVIRUS

Click on FILE ANTIVIRUS option. Copy exactly my setup here.

Action on thread detection: disinfect, delete if fails
Heuristic Analysis: light scan
Scan only new and changed files: check
Scan mode: on execution

The rest of the options are default.

Spoiler: SAFE BROWSING SETTINGS

Click on SAFE BROWSING SETTINGS option. Copy exactly my setup here.

Action on threat detection: Block download
Scan method: check all

The rest is default.

Spoiler: FIREWALL

Click on FIREWALL option. Check every box there is.

Spoiler: INTRUSION PREVENTION

Click on INTRUSION PREVENTION option. Copy exactly my setup here.

Trust group for applications that could not be added to existing groups: Untrusted
Trust group for applications started before startup of Kaspersky: Low Restricted
Trust digitally signed applications: unchecked



This specific configuration for the Intrusion Prevention module will be the key for a "lockdown" protection. Whenever an unknown application, wether its signed or not, is executed, it will be automatically blocked for your protection (it doesn't get safer than this). If you encounter an app you trust to be blocked, just head to this module, click on "Manage applications", filter for "Untrusted" and move it to the "Trusted" group.

For more information on how this module works, check: Need Advice - Kaspersky's Application Control: what is it, how it works

Spoiler: NETWORK

Click on NETWORK. Copy my exact setup here.

Traffic processing: check all
Encrypted connection scan: do not scan

The rest is default.

Spoiler: PRIVATE BROWSING

Click on PRIVATE BROWSING. Copy my exact setup here.

Block data collection: selected
Block tracking: checked
Allow data on Kaspersky website: unchecked
Allow data collection on incompatible websites: checked

Spoiler: What about the rest?

If a module is not listed here, that's because my suggestion is to leave it default, as it's the best approach for a light, yet solid protection.
I've skipped the "PERFORMANCE" and "PRIVACY" tabs, since they're not the main objective of this thread. Nevertheless, I encourage you to take a look at them and see which module here you find useful.

That concludes our Kaspersky's Tweaking Guide for the ultimate light yet solid protection.

"Wait, RoboMan, don't leave! I'm too lazy to do all this! Can't you just give me a configuration file I can import?"

You lazy mortal... Of course I thought of you, take it:

CONFIGURATION FILE:

UPLOAD.EE - KASPERSKY_STANDARD_2023.cfg - Download

KASPERSKY_STANDARD_2023.cfg - Download. Upload.ee

www.upload.ee

This includes my suggestion tweaks for "PRIVACY" and "PERFORMANCE" tabs too. To import it, just head to settings icon on the home interface (located on the bottom part), now head to "Manage Settings", and use the "Import" option.

------------------------------

You may have questions, doubts, or may even want to drop a life threat, so feel free to do all that on the comment section.

 

[ForgottenSeer 93475]

good @RoboMan
But why specify (inject script into web traffic to interact with web pages)
I thought it was slowing down browsing,Has anything changed in the new versions?

 

[RoboMan]

good @RoboMan
But why specify (inject script into web traffic to interact with web pages)
I thought it was slowing down browsing,Has anything changed in the new versions?

I chose to include the script injection into the browser for security reasons. I don't like the idea of having to install third-party browser addons like MalwareBytes Browser Guard or BitDefender TrafficLight. I believe the built in web protection is a more transparent and non-intrusive approach.

Also, I haven't encountered browsing slowdowns worth mentioning (on decent connection speeds at least).

 

[outlawxtorn]

Another good guide, thanks @RoboMan !

 

[Berny]

@Dixz45

Also, the Network Setting "Inject script into web traffic to interact with web pages"
is needed for the functioning of Kaspersky Safe Money , Private Browsing ... components.

 

[ForgottenSeer 93475]

I chose to include the script injection into the browser for security reasons. I don't like the idea of having to install third-party browser addons like MalwareBytes Browser Guard or BitDefender TrafficLight. I believe the built in web protection is a more transparent and non-intrusive approach.

Also, I haven't encountered browsing slowdowns worth mentioning (on decent connection speeds at least).

I remember it was a discussion on this topic and it said that the program will block malware even though this option is disabled using the built-in web protection, but it seems that you mean that this option provides additional protection and security
I will activate it and test the internet speed and agree that it will not be a problem with very fast connections

@Dixz45

Also, the Network Setting "Inject script into web traffic to interact with web pages"
is needed for the functioning of Kaspersky Safe Money , Private Browsing ... components.

View attachment 274663

I disable most of the features on which this option depends, so I did not find a reason to activate it, but if it adds additional security and does not affect the speed of the Internet clearly, I will do it

 

[RoboMan]

I disable most of the features on which this option depends, so I did not find a reason to activate it, but if it adds additional security and does not affect the speed of the Internet clearly, I will do it

It depends on the user, Chrome's built in security is already decent enough. I still see no reason why to add Kaspersky's protection if it doesn't slow you down.

 

[ForgottenSeer 93475]

It depends on the user, Chrome's built in security is already decent enough. I still see no reason why to add Kaspersky's protection if it doesn't slow you down.

I did a speed test and it didn't seem to have any negative effect so I activated it

 

[HarborFront]

Just installed Kaspersky Standard trial on one laptop. This guide would be useful to me.

 

[Evjl's Rain]

I did a speed test and it didn't seem to have any negative effect so I activated it

it does not affect internet speed but affects browser's responsiveness
I used script injection on my i7-3630QM. It made chrome respond a lot slower with more CPU consumption especially on heavy websites (facebook)

if you use kaspersky free, you can disable it. it's almost useless because free version doesn't have the important features that require script injection (except for URL advisor, most of us dont need)
with paid versions, there are some important components requiring it

 

[likeastar20]

Why heuristics set to light?

 

[RoboMan]

Why heuristics set to light?

Because we're not using heuristics as our main line of defense, and because we're trying to make Kaspersky as light as possible. Our first line of defense with this configuration is Application Control (now Intrusion Prevention), which will block unknown files and mark them as untrusted. A quick, light heuristic scan is enough for this approach, since we rely more on KSN Vendor's List rather than on scanning files for malicious behaviour. Still, if you allow (mark as Trusted) a malicious file, heuristics will play its role, and even if it fails, Kaspersky's Intrusion Prevention will pop up again blocking a payload for lacking a signature or not being signed by a Trusted Vendor.

In most cases, our configuration will stop a threat prior full execution due to this aforementioned configuration.

 

[harlan4096]

You can turn off this specific notification:

 

[Trident]

You can turn off this specific notification:

View attachment 274841

I didn’t see that. Where is it located? Apparently you can disable the writing in events as well. That’s great.

 

[harlan4096]

Notification Settings:

 

[Trident]

Notification Settings:

View attachment 274844

I looked there and didn’t see it

In that case Kaspersky will be great to restrict various LOLBins. I’ll need to have a look which are the most abused ones and how the actual abuse can be blocked.

Off the top of my head, blocking creation of startup items, starting processes(that’s under a question mark if it should be implemented) and code injection may be enough. Potentially maybe blocking the network access as well.

 

[harlan4096]

I have one question about how did You create the rule (path to folder) to protect Edge cookies: did You just add the folder path or added "\*" at the end? Since in the pic is not clear / not shown the full path:

 

[Trident]

I have one question about how did You create the rule (path to folder) to protect Edge cookies: did You just add the folder path or added "\*" at the end? Since in the pic is not clear / not shown the full path:

View attachment 274848

View attachment 274849

For the Edge cookies I added the star so it will block everything in the folder (passwords, autofill, cookies). For the ransomware protection I’ve not specified any additional rules like formats (users can play a bit more and do it).

There are many possibilities what can be done with this module, I was surprised actually. Other HIPS are not that useful.

 

[piquiteco]

@harlan4096 @Trident restrict access to these folders from browsers Edge AppData\Local\Microsoft\Edge\User Data do Chrome AppData\Local\Google\Chrome\User Data Firefox C:\Users\<user account>\AppData\Local\Mozilla\Firefox\Profiles Wouldn't that protect the cookies?

 

[harlan4096]

I think in FF is: C:\Users\<user account>\AppData\Roaming\Mozilla\Firefox\Profiles