Data on files that are blocked from starting

Data on files that are blocked from starting is stored in open non-encrypted form in the folder C:\ProgramData\Kaspersky Lab\Endpoint Agent\protected\kata.

By default, only users with System and Administrator permissions have read-access to files when Self-Defense is enabled. When Self-Defense is disabled, users with System and Administrator permissions can also delete the files, modify their contents, and modify the access rights to them. Kaspersky Endpoint Agent component does not manage access permissions to this folder and any files in it. It is the system administrator who determines access permissions.

Data on files that are blocked from starting may contain the following information:

• Full path to the blocked file.
• MD5 hash of the file.
• SHA256 hash of the file.
• Process start command.

See also Data received from the Central Node component Data in fields of Windows Event Log events of Kaspersky Endpoint Agent Data in Kaspersky Endpoint Agent for Windows requests to Kaspersky Anti Targeted Attack Platform Service data of Kaspersky Endpoint Agent for Windows Data contained in Kaspersky Endpoint Agent for Windows trace files and dumps Data sent to Kaspersky if the KSN Statement was accepted Data in alerts and events Data contained in task completion reports Data contained in an install log Data related to the performance of tasks

Page top