CIS Program Sandboxing Policy/Criteria, etc...

Comodo Internet Security - CIS Defense+ / Sandbox Help - CIS
1

Since version 8 CIS introduced new autosandbox default rules i.e “Internet” that replaced “Any”. Now I dont know how the “Internet” rules decides to autosandbox the programs, on what basis…what criteria…are considered by the “Internet” rules to decide to autosandbox the programs or not…but I must say “Internet” rules seems a vast improvement & have definitely made CIS a lot better & usable especially for average users.

Nowadays I am trying latest CIS with default settings. For usability check, I installed/updated/upgraded, etc… quite many programs i.e average users programs/popular programs/required programs & some not so popular programs, etc…& not a single program was autosandboxed or generated alerts. Thats a huge plus & improvements.

But I am confused a little. Programs installed were not autosandboxed but some programs entries are there in Unrecognized Lists - [b]Can anyone explain this? Programs are working fine & definitely not running sandboxed thats good.
Is this expected behavior & something new as per new autosandbox default rules “Internet” & other policies, criteria, etc…?

2

I’m willing to bet those entries that are listed as unrecognized are .dll files or temporay executables that were ran during the install.

3

Attached is the screenshot

[attachment deleted by admin]

4

None of those are digitally signed, so they can’t be recognised except by the cloud and after it’s been manually white-listed there. cf. Sandboxing Process | Comodo Internet Security | Comodo Internet Security Help

5

Some files of those programs are in Trusted Lists & some in Unrecognized Lists. So what does this means? Were those programs not installed normal/complete install as some files are in Unrecognized Lists? All those programs run normal i.e not virtualized/no green border.

6

Installed Trojan Hunter.

No files in Trusted Lists. Files in Unrecognized Lists. I didn’t get any alerts. Trojan Hunter runs fine i.e not virtualized/no green border. KillSwitch also shows virtualization disabled for Trojan Hunter.

Attached is the screenshot of Unrecognized Lists.

[attachment deleted by admin]