Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1071104" data-attributes="member: 96560">Re-installed machine a couple of days ago keeping the configuration except:Changed Comodo Internet Security 2024 Beta back to Xcitium OpenEDR (Comodo). Because I prefer to get&nbsp; Alerts from the web console. and I can view them from another machine. And OpenEDR gives me the Investigations capability, allowing me to search the logs, and see the process tree. Seeing the process tree allows me to determine if the exe was launched normally, interactively by me or via some exploited service. Eg. SvcHost should not be the parent of Powershell.ReviOS is gone. It did give noticeable performance boost to my aging 3rd gen Core i5, but I missed MS Defender core isolation. ReviOS took away MS Defender entirely. And the machine is capable of running regular Win 11 just fine. Startup is now slower, but so what - Protection trumps convenience.Upgraded Malwarebytes Anti-Exploit to the latest version. It was unable to keep the old configuration files which I had backed up, so had to re-do adding new shields. Added more shields for the Windows exe&#039;s allowed by Comodo&#039;s &#039;System&#039; firewall rule. Can&#039;t seem to get rid of that &#039;Systems&#039; rule - it keeps adding it back in again. So according to PCI DSS, I had to protect vulnerable protocols, and MBAE is my answer to that requirement. That &#039;Systems&#039; firewall rule allows a whole bunch of Windows exe&#039;s - crsss, logonui, smss, services, spoolsv ... . It certainly adds to the attack surface. I will complain to Xcitium - those exe&#039;s definitely Do Not Need to talk thru the firewall.</blockquote>

[QUOTE="Victor M, post: 1071104, member: 96560"] Re-installed machine a couple of days ago keeping the configuration except: Changed Comodo Internet Security 2024 Beta back to Xcitium OpenEDR (Comodo). Because I prefer to get Alerts from the web console. and I can view them from another machine. And OpenEDR gives me the Investigations capability, allowing me to search the logs, and see the process tree. Seeing the process tree allows me to determine if the exe was launched normally, interactively by me or via some exploited service. Eg. SvcHost should not be the parent of Powershell. ReviOS is gone. It did give noticeable performance boost to my aging 3rd gen Core i5, but I missed MS Defender core isolation. ReviOS took away MS Defender entirely. And the machine is capable of running regular Win 11 just fine. Startup is now slower, but so what - Protection trumps convenience. Upgraded Malwarebytes Anti-Exploit to the latest version. It was unable to keep the old configuration files which I had backed up, so had to re-do adding new shields. Added more shields for the Windows exe's allowed by Comodo's 'System' firewall rule. Can't seem to get rid of that 'Systems' rule - it keeps adding it back in again. So according to PCI DSS, I had to protect vulnerable protocols, and MBAE is my answer to that requirement. That 'Systems' firewall rule allows a whole bunch of Windows exe's - crsss, logonui, smss, services, spoolsv ... . It certainly adds to the attack surface. I will complain to Xcitium - those exe's definitely Do Not Need to talk thru the firewall. [/QUOTE]

Verification