You have to use Proactive Security and make sure you have “Perform script analysis” enabled and set the protection level of run virtualized to Limited or Restricted.
I would like to know too if CIS is able to detect malware entering a computer via trusted remote control software like Kaseya and if CIS is still able to block it or to run it in containment.
If Kaseya software itself is rated trusted what will be the rating of the malware then?
In the settings i had already chosen the proactive one (I just disabled HIPS for fear of making mistakes when pop-ups of choice appear) and in the containment settings I did as you said.
Here are the settings (the language is Italian ;D …)
Thanks! 
:-TU
if it entering a computer via Windows itself CFW would block it
experiencing too much BSoD with CFW already so it’s like blocking even system files too but settings is not default (Cs’s)
:P0l
I wonder if the FW block will happend with Alert Incoming (Proactive Config default FW Config) as well as Block Incoming CF/IS default. I suppose you’d still get an alert giving you the option to block it.
Head scratching . . .
Will there be a FW Alert when Kaseya software initiated the connection and malware piggybacks on that connection?
I bet it will be blocked without alert when CFW properly setted up
:P0l
Not very convincing, I still have my doubts. . . :P0l
With HIPS and script analysis enabled CIS should block unknown program from piggybacking on executables.
Regarding the Kaseya attack, Comodo does quite well against it. As the initial ransomware is digitally signed (PB03 TRANSPORT LTD), it was passed by some anti-malware applications prior to the revocation of the certificate.
The fact that the malware was signed presents no issue to Comodo. Utilizing CF (even without the AV and HIPS functionality), containment at the lowest level will stop the malware. Specifically note that the ransomware has two modes- the first is a Powershell script that seeks to disabled Windows Defender and modifies Windows firewall with the “netsh advfirewall firewall set rule group” routine. Along with certutil these are recognized and blocked from action. A batch script will run the ransomware itself.
The main ransomware routine is rather pretty as it will drop a legitimate version of Windows defender (specifically MsMpEng.exe) as well as the payload in the form of a malicious mpsvc.dll which will then be loaded by Windows Defender in a side-loading attack.These are also contained with the only evidence of ransom activity being encrypted files within Containment, all of which can be flushed without any system changes (also, no outbound network requests exist with the malware).
These are really the essentials of this malware attack and could have resulted in less victims if Comodo was employed.
1 Like
Many thanks for the info M 
Read here … 
https://techtalk.comodo.com/2021/07/08/kaseya-vsa-breach-consequences-of-security-failures/
I am really impressed that Comodo has come out with such a well done and easily understandable article. The only addition that one could make is that the malware also contained the “netsh advfirewall firewall set rule group=“Network Discovery” new enable=Yes” batch command (easily missed) which is also contained by Comodo.
1 Like
cruelsister, can you, please, post your cis configuration (updated withh anything you think is important) in text not video? just so i can check it out, try it again, translate it and make it easier for people in brazil to understand… maybe, if possible, can we have an script or regedit that will do your configuration without the user opening the cis config window?
imagine that: a user installr cis, run an reg file (or cmd) and its all set!!! nothing more to worrie… that would be magic!!! 
I think this not necessary. That would be a lot of work.You can stop the video and follow each step or two steps without having to read.
Hi Prodex! Not an issue, and after yesterday’s Football match I’m sure Victor needs something else to think about (PM sent)!
General info, blindly importing a config into CIS from another computer is asking for troubles.
Perhaps wait and see? An interesting concept depending on the goal and capability
Very true and without config format specifications very challenging.
I think so, too.
This has happened twice as long as I’v been using comodo (and for a very, very long time). ). But never could I recommend all my additional settings. Basis was proactive + cruelsister’s video, and my settings are certainly not completely free of error and that alone is the reason not to share my settings to apply them.