How does Kaspersky deal with RATS/Backdoors

[Xeno]

Kaspersky has good scanners, signatures, and good protection against rats and backdoors. However, what happens if the connection is setup and they have access to your system?
Are they able to just steal all your files with Kaspersky noticing, or will Kaspersky deal with it?

[Xzz123]

you can set up rules for hips

to block all internet connection in low restricted group.

and allow certain app as you wish

[Xeno]

15 hours ago, Xzz123 said:

you can set up rules for hips

to block all internet connection in low restricted group.

and allow certain app as you wish

Besides setting custom HIPS rules. Does kaspersky do anything to protect you if the connection is established?

[Xzz123]

1 hour ago, Xeno said:

do anything to protect you if the connection is established

from my experience

unless the program is detected by systemwatcher or you have disable automatic mode

the answer is no.

If the IP which the rat connected is not in K's blacklist, K will not block unknown IP.

But I do know some AV vendor behave much more aggressive, sometimes block unknow connections.......

 

[Xeno]

I mean what if like the connection is established, but it does malicious stuff? Can it detect the rat if the connection is established but the connection isnt detected via what the rat does?

Edited July 8, 2023 by Xeno

[Schulte]

Hello @Xeno,

if an unwanted remote connection could be established, this is of course fatal. The attacker could, depending on the Windows settings, extract data. Kaspersky products offer efficient ways to prevent this, e.g. remote access is disabled by default.

But if we assume the bad case that such a connection could be established, the attacker will want to execute further malware on your computer. This will of course be monitored by System watcher/Intrusion Prevention like any other program. Since malware rarely has a valid digital signature and is also listed as harmless by Kaspersky, the 'extra' should be detected and blocked.

[Xeno]

What if the connection is established? I've seen this happen before. Does kaspersky protect against what the rat is capabile of aswell?