Kaspersky not detect and block abnormal encrypt files activities

[JohnCateer86]

Hello,

Kaspersky Endpoint Security cannot detect PS1 file contain abnormal script run encrypt files as the attach files.

Does Kaspersky verify it again?

https://github.com/Tai-bdev-vn/Encrypt-Delete-Test/blob/main/EncryptDelTestv4.1.ps1.txt

[JohnCateer86]

Kaspersky doesn't seem to be making improvements to enhance its quality, does it?

 

https://www.virustotal.com/gui/file/6f6a3540cf024e17b8f6964d4dcab82ca692c49354845e5f40d60c904535e3a3

[harlan4096]

Welcome to Kaspersky Community.

 

I tested that .jar in a VM with KES 12.8 + W11 in a virtual machine, and can confirm that KES does not warn about encrypting...

 

But some considerations about that tool:

 

It seems it's a POC (Proof of Concept Tool), that of course uses legit operating system commands to encrypt the system, so this makes it difficult to discern the really malicious behavior of the script.

 

Also, does that tool really behave maliciously, enough for Kaspersky to consider it malicious? 🤔

[JohnCateer86]

I tested other vendors, and they all detected and blocked it. It seems that other vendors are better at preventing ransomware compared to Kaspersky.

 

 

 

[Flood and Flood's wife]

42 minutes ago, JohnCateer86 said:

I tested other vendors, and they all detected and blocked it. It seems that other vendors are better at preventing ransomware compared to Kaspersky.

 

Hello @JohnCateer86, 

IF (you) have licensed Kaspersky software (you're) more than welcome to submit the files via (your) company account & request they get sent to Kaspersky's Virus Lab experts for analysis; make sure to zip the files - password protect the archive - use either MALICIOUS or INFECTED - as the password & tell support the password. 

Also, these documents may interest (you) - for general information; they're available in the Home user's repository: https://support.kaspersky.com/b2c/global: 

Thank you🙏
Flood🐳+🐋

Edited February 21 by Flood and Flood's wife
pn

[harlan4096]

I've reported the tools (.ps1 and the .jar), waiting the verdict from K. analysts.

 

Still that's a simulator, a POC, not a real rsw... and it needs the intervention of the user to Encrypt and Decrypt..

[JohnCateer86]

I still haven't seen any updates on Kaspersky being able to detect and prevent this behavior, while other vendors offer good protection. LOL😆

[JohnCateer86]

If the scripts above are saved as .ps1 files, Kaspersky can detect and block them. However, if they are obfuscated or executed directly by an attacker, Kaspersky cannot detect abnormal behavior or prevent the attack.