Comodo Firewall isolates its own script??

[Citizen_K]

This post from egemen, the former lead developer of CIS explains it:

@egemen

After clean install of CIS 10, a bunch of C_cmd.exe_.bat in C:\ProgramData\Comodo\Cis\tempscrpt are being sandboxed.

Anyone else is getting that?

Win 10 x64

Oh yes. This is a new feature we have introduced to catch fileless malware. Fileless malware uses script interpreters such as powershell.exe to execute code through commandline. There are various ways. What CIS 10 does is it catches embedded commandlines and sandboxed them.

But while sandboxing them, we create a file out of them i.e. convert file-less scripts into files in C:\ProgramData\Comodo\Cis\tempscrpt. If is the command-line interpreter. What you can do is

1-You can trust them just like any other file
2- Or you can disable cmd.exe from commandline parsing from Settings->HIPS->Do Heuristics commandline analysis(Certain applications)