Create Rules To Auto-Contained Applications | Network Access |Internet Security

Create Rules to Auto-Contain Applications

Click 'Settings' > 'Containment' > 'Auto-Containment'

Auto-containment rules determine whether a program is allowed to run as normal, run with restrictions, or run in the virtual environment.

A contained application has much less opportunity to damage your computer because it is isolated from your operating system, important system files and personal data.

CIS consults these rules whenever you open an application. Rules at the top of the list have a higher priority. You can re-prioritize rules using the 'Move Up' and 'Move Down' buttons.

Programs running in the container have a green border around them.

CIS ships with some pre-defined rules configured to provide maximum protection for your system. Click here to check whether these rules meet your needs before creating a custom rule.

The rest of this tutorial explains how to create a custom auto-containment rule.

Сreate an auto-containment rule

1. Click 'Settings' on the CIS home screen

2. Click 'Containment' > 'Auto-Containment'

3. Make sure 'Enable Auto-Containment' is selected

4. Click 'Add'.

The add rule screen contains two tabs:

Criteria - Define the conditions of the rule.

Options - Configure additional actions like logging, memory usage and time restrictions.

There are three steps:

Step 1 – Choose the action

Step 2 – Select the rule target/group and set the filter criteria for the target files

Step 3 – Choose additional options

Step 1 - Select the Action

The setting in the action drop-down combined with the restriction level in the options tab determine the privileges of an auto-contained application. These items specify what right the application has to access other processes and hardware resources.

Choose one of the following actions:

Run Virtually - The application will run in a virtual environment, completely isolated from your operating system and the rest of your files.

Run Restricted - The application is allowed limited access to operating system resources. The application is not allowed to execute more than 10 processes at a time. Some applications, like games, may not work properly under this setting.

Block - The application is not allowed to run at all.

Ignore - The application is not contained. It is allowed to run as normal on your computer.

Step 2 - Select the target file/group and set the filter criteria

The next step is to select the target files and configure filters.

You can add rule filters so the rule only applies to specific types of file.

For example, you can specify 'All executables' as the target and add a filter so it only affects executables downloaded from the internet

Another example is if you want to allow unrecognized files created by a specific user to run outside the container. You would create an 'Ignore' rule with 'All Applications' as the target and 'File created by specific user' as the filter criteria

Select targets and filters

Click the 'Criteria' tab

Click the 'Edit' button at the far right:

Select the target

Configure filters

Select the target

Click the browse button next to the file location field:

Select one of the following target types:

Files - Add individual files as the target.

Running Processes - Add any process that is currently running on your computer. This targets the parent application of the process.

File Groups - Add a predefined file group as the target. For example, the 'Executables' group contains a list of file types that can run code on your computer. Click 'Settings' > 'File Rating' > 'File Groups' to add or modify a file group.

Folder - Add a directory or drive as the target. All files in the target folder are covered by the rule.

File Hash - Add a file's hash value as the target of the rule. A hash value is a number derived from the file itself, which uniquely identifies and represents the file. It is extremely unlikely that two files can ever generate the same hash value. The rule will apply to the target file, even if the file name changes.

Process Hash - Add a processes hash value as the target of the rule. Please see description above if required.

Add an individual file

Choose 'Files' from the 'Browse' drop-down

Navigate to the target file and click open

The file will be added as the target and run as per the action chosen in Step 1.

Click 'OK' if you don't want to specify any filters or options.

If required ,you can configure filter criteria and file rating and Options for the rule.

Add a currently running process

Choose 'Running Processes' from the drop-down:

A list of processes currently running on your computer will be displayed.

Select the process belonging to the parent application you want to add and click 'OK'.

The parent application of the process is added as the target and run as per the action in Step 1.

Click 'OK' if you don't want to specify any filters or options

If required, you can configure filter criteria and file rating and Options for the rule.

Add a file group

Choose 'File Groups' from the drop-down

For example, the 'Executables' group contains a list of file types that can run code on your computer. Click 'Settings' > 'File Rating' > 'File Groups' to add or modify a file group.

Select the file group you want to target with the rule:

Click 'OK' if you don't want to specify any filters or options.

If required, you can configure filter criteria and file rating and Options for the rule.

Add a folder/drive partition

Choose 'Folder' from the drop-down:

Navigate to the drive partition or folder you want to add as target and click 'OK'

Click 'OK', if you don't want to specify any filters or options.

If required you can configure filter criteria and file rating and Options for the rule.

Add a file using its hash value

Choose 'File Hash' from the drop-down:

Navigate to the file whose hash value you want to add as target and click 'Open'

Click 'OK', if you don't want to specify any filters or options

If required you can configure filter criteria and file rating and Options for the rule

CIS generates the hash value of the parent file and stores that as the target

CIS uses this hash value to identify the file and apply the rule, so that the rule intercepts the target even if the file name changes.

Add an application from a running process based on its hash value

Choose 'Process Hash' from the 'Browse' drop-down

Select the process, to add the hash value of its target application to target and click 'OK' from the 'Browse for Process' dialog

Click 'OK', if you don't want to specify any filters or options

If required you can configure filter criteria and file rating and Options for the rule

CIS generates the hash value of the parent file and stores that as the target

CIS uses this hash value to identify the file and apply the rule, so that the rule intercepts the target even if the file name changes.

Configure Filter Criteria and File Rating

You can apply an action to a file if the file meets certain criteria.

The available criteria are:

By application that created the file

By process that created the file

By user that created the file

By file origin

By the file rating

By vendor who signed the file

By file age

Auto-contain a file if it was created by a specific application

This will apply the rule to a file based on its parent application.

You can also specify the file rating of the parent application. The rule will then only contain a file if the parent app has a certain trust rating.

Specify parent applications

Click the add button in the 'File Created by applications' stripe:

Browse to and select the target application. Click 'OK'

Click the 'Any' link beside 'File Rating' to select the rating of the parent application:

Select 'Trusted', 'Unrecognized' or 'Malicious'. For example, select 'Unrecognized' to contain all files created by programs which have no trust rating

Leave this at 'Any' to contain all files created by the target application

Repeat the process to add more applications or groups/folders

Auto-contain a file if it was created by a specific process

This will apply the rule to a file based on its based on its parent process

You can also specify:

The trust rating of the parent process. The rule will then only contain a file if the parent process has a certain trust rating

The number of levels in the process chain that should be inspected

To specify source process:

Click the 'Add' button in the 'File Created by Processes' stripe:

Browse to and select the target process. Click 'OK'.

Click the 'Any' link beside 'File Rating' to select the rating of the parent application:

'Number of parent process levels to be analyzed' - Specify how far up the process tree CIS should check. 1 = will only check the trust rating of the file's parent process. 2 = will check the trust rating of the parent process and the grand-parent process. Etc.

Repeat the process to add more processes

Auto-contain a file created by specific users

Click the 'File Created by Users' stripe and then click the 'Add' button.

Enter the names of the users you want to add in the large text box.

Name format = [domain name][user/group name], or [user/group name]@[domain name].

Alternatively, click 'Advanced' then 'Find Now' to locate specific users. Click 'OK' to confirm your choice.

The user will be added to the list.

Repeat the process to add more users

Auto-contain a file if it was downloaded/copied from a specific source

Click the 'Add' button in the 'File Origins' stripe:

Choose the source from the options:

Internet - Apply the rule to files that were downloaded from the internet.

Removable Media - Apply the rule to items copied to your computer from removable storage devices.

Intranet - Apply the rule to files downloaded from the local intranet.

Repeat the process to add more sources

Select file rating as filter criteria

Click the 'Select' button in the 'File Rating' stripe

This will apply the rule to files which match the trust rating you set. You can choose from the following trust ratings:

Trusted - Applications are categorized as 'Trusted' if:

The file is on the global whitelist of safe files

The file is signed by a trusted company in the Vendor List

The file was installed by a trusted installer

The file was given a trusted rating in the File List by a user

See File Rating Settings for more information

Unrecognized - Files that do not have a current trust rating. The file is on neither the blacklist nor the safelist, so is given an 'unknown' trust rating. See File List for more information.

Malware - Malicious files – those that are on the blacklist of known harmful files.

Auto-contain a file based on the software vendor

You can apply an action to a file based on the vendor who digitally signed the file. The vendor is the software company that created the file.

You can also specify the trust rating of the vendor. The rule will only contain a file if its vendor has the stated trust rating.

Choose vendors:

Click the 'Add' button in the 'File Created by Processes' stripe

There are three ways you can add a vendor:

1. Directly select a vendor

Choose 'Vendor from a Vendor List' from the drop-down

The 'Add Vendor' dialog opens with a list of vendors in the Vendor List

Use the sort and filter options in the column headers to search for the vendor to be specified

Choose the vendor and click 'OK'. The vendor will be added as a criterion

2. Specify an executable file on your local drive

Choose 'File Signer' from the drop-down

Navigate to the executable file whose publisher you want to add as the criteria and click 'Open'

CIS checks that the .exe file is signed by the vendor and counter-signed by a Trusted CA. If so, the vendor is added as a criteria

3. Select a currently running process

Choose 'Running Process Signer' from the drop-down

A list of all processes running at present on your computer is shown

Select the process to specify the publisher of the application that started the process and click 'OK'

CIS checks that the .exe file that started the process is signed by the vendor and counter-signed by a Trusted CA. If so, the vendor is added as a criteria

The selected vendor is added:

Vendor Rating - The rule will only apply to the vendor’s files IF the vendor has this rating at the time the file is checked. Note, the rating you set here can be different to the actual vendor rating in ‘Settings’ > ‘File Rating’ > ‘File List’ > ‘Vendor Rating’.

Example. If you select ‘Trusted’ here, then CIS will apply the rule if the vendor is trusted at the time the file is checked. If the vendor’s rating changes to ‘Malicious’ or ‘Unrecognized’, then the rule isn’t applied.

Repeat the process to add more vendors

Set the file age as filter criteria

Click the 'Select' button in the 'File age' stripe.

The 'File Age' dialog will appear. You can set the file age in two ways:

File creation date – To set a threshold date to include the files created before or after that date, choose this option, choose 'Before'/'After' from the first drop-down and set the threshold date and time in the respective combo-boxes.

File age – To select the files whose age is less than or more than a certain period, choose this option and specify the period.

Less Than – CIS will check for reputation if a file is younger than the age you set here. Select the interval in hours or days from the first drop-down combo box and set hours or days in the second drop-down box. (Default and recommended = 1 hours)

More Than - CIS will check for reputation if a file is older than the age you set here. Select the interval in hours or days from the first drop-down combo box and set hours or days in the second drop-down box. (Default and recommended = 1 hours)

Click 'OK' in the File Criteria dialog after selecting the filters to save your settings to the rule. The list of criteria will be displayed under the Criteria tab in the 'Manage Contained Program' dialog.

Step 3 – Select the Options

The next step is to choose additional options and restrictions on items contained by the rule.

Click the 'Options' tab.

The options available depend on the 'Action' chosen in Step 1.

The 'Ignore' action has the following options:

Log when this action is performed - Whenever this rule is applied for the action, it will be added to CIS Containment logs.

Don't apply the selected action to child processes - Child processes are those started by the target application.

This option is disabled by default, so the ignore rule also applies to child processes.

If enabled, the ignore rule does not apply to child processes. Each child process will be inspected individually and all relevant rules applied.

The 'Run Restricted' and 'Run Virtually' actions have the following options:

Log when this action is performed - Whenever this rule is applied for the action, it will be logged.

Set Restriction Level - When Run Restricted is selected in Action, then this option is automatically selected and cannot be unchecked while for Run Virtually action the option can be checked or unchecked. The options for Restriction levels are:

Partially Limited - The application is allowed to access all operating system files and resources like the clipboard. Modification of protected files/registry keys is not allowed. Privileged operations like loading drivers or debugging other applications are also not allowed. (Default)

Limited - Only selected operating system resources can be accessed by the application. The application is not allowed to execute more than 10 processes at a time and is run without Administrator account privileges.

Restricted - The application is allowed to access very few operating system resources. The application is not allowed to execute more than 10 processes at a time and is run with very limited access rights. Some applications, like computer games, may not work properly under this setting.

Untrusted - The application is not allowed to access any operating system resources. The application is not allowed to execute more than 10 processes at a time and is run with very limited access rights. Some applications that require user interaction may not work properly under this setting.

Limit maximum memory consumption to - Enter the memory consumption value in MB that the process should be allowed.

Limit program execution time to - Enter the maximum time in seconds the program should run. After the specified time, the program will be terminated.

The 'Block' action has the following options:

Log when this action is performed - Whenever this rule is applied for the action, it will be added to CIS Containment logs.

Quarantine program - If selected, the applications satisfying the rule will be automatically moved to CIS quarantine. See Manage Quarantined Items for more information.

Choose the options and click 'OK'. The rule will be added and displayed in the list.

You can move the rule up or down the list to change its priority.

Important Note: Please make sure auto-containment rules do not conflict. In the event of a conflict, the setting in the rule that is higher in the list prevails. The 'Reset to Default' button lets you restore the original rules.

Comodo Internet Security

Version 12.2

English

Create Rules to Auto-Contain Applications