I’m having a hell of a time with Comodo doing the temporary scripts.
I can’t seem to whitelist, it ANYWHERE in the settings to prevent it, and The logic here, is blowing my mind… in the … … ‘frustrating ways’
I use scripts to autotmate moving, naming a load of WTV files around.
if EXIST %Fo%In_Use_By_DEL-CABLECARD.txt ( Goto INUSE )
for %%a in (%Fo%%Fi%) do (
::echo Copying, Verifying, Moving %%a
powershell.exe -file Base.ps1 “%%a” %Fd%
echo Transfer In Use
Now… The crazy part I’ve trusted both that *bat file, & the Base.ps1 file. Have windows protect every folder that holds the WTV files (so that not even comodo can access them), and allowed access to that bat file (and 2 others)…
What’s in the temporary script… (this is the part that when I looked… blew my mind and I am honestly VERY lost as to how the hell to stop it from doing something this stupid)
It has no problem … with the custom Ps1 file… what so ever. It dives into files reads deeply embeded meta data, writes into protected folders, changes the system date & time …
How do I stop it from … basically Creating a script to call the exact same PS1 file I was going to call, and allow the bat file to use esablished permishions, instead of having to REDO THEM WITH EVERY SINGLE FILE, because… it litterally creates a new Tempscript each pass through… & … if it’s not to obvious… I tend to go through… ALOT of them.
This is due to protection against file-less malware feature.
It creates temporary file out of every distinct command passed to powershell.
Yes this feature is bit frustrating for cases where application could be running for genuine cases; we are going to make it more intelligent in next CCAV release and will then port same solution to CIS in subsequent releases.
For now, if you want to get rid of it, please de-select “Embedded Code Detection” option against powershell.exe as shown in enclosed snap.
You can access above option via: Settings–>Advanced Protection–>Miscellaneous–>“Do heuristic command-line…” related “certain applications”
It will lower security for exploits based on powershell, so over to you.
You can mark a script file as safe and pass that as command line arguments and you won’t get alert as whole file is treated safe. e.g. you can have set of DOS commands inside a batch file, mark it safe and execute, you won’t get alert.
Passing Command Line Params:
You are passing certain commands to interpreter, in your case powershell, considering an exploit can also call powershell with certain commands, it becomes suspicious case. At the moment we don’t analyze contents of file.
In your case, you are having a batch file, even if you mark safe, you won’t see sandboxing of batch file, but it is using powershell with variable commands passed to it. So even though batch file is safe, but it is using another application and passing commands. As you know the way batch files are processed, they are one line at a time so unless you analyze contents of file, you don’t know the source, they simply end up seen as isolated executions with variable commands.
So you have mixed situation, a batch file, that uses powershell with variable command line options. Unless, we analyze file contents and control execution out of it, you will see the problem.
Yes, it’s not very intelligent at the moment, but we are working on to improve it further.