I already know that autocontainment supports embedded code detection, but does HIPS support it?
I have a certain bat script that runs at system startup, every time with a different random name. So if I enable embedded code detection for cmd.exe, I run into problems with autocontainment.
What if I make an ignore rule for cmd.exe in autocontainment? Will HIPS then do the embedded code detection?
Or do I need to change the file rating of cmd.exe to unrecognized?
Proactive config, HIPS safe mode.
To answer my own question: yes, HIPS supports it, and no, it is not necessary to rate cmd.exe as unrecognized.
I disabled autocontainment, and I launched a program that runs a powershell script, and I got HIPS prompts for a Cis tempscript. So I can see that it works.