Enabling detection of legitimate applications that can be used by cybercriminals

Expand all | Collapse all

This Help provides information related to Kaspersky Endpoint Agent for Windows. This information may be partially or completely inapplicable to Kaspersky Endpoint Agent for Linux. For complete information about Kaspersky Endpoint Agent for Linux, please refer to the Help of the solution that includes the application: Kaspersky Anti Targeted Attack Platform or Kaspersky Managed Detection and Response.

You can enable detection of legitimate applications that could be used by cybercriminals to harm your organization computer network. Kaspersky Endpoint Agent considers such applications as threats and performs threat response actions on them.

Legitimate applications are allowed to be installed and used on user computers and are designed to perform user tasks. However, some types of legitimate applications, when used by cybercriminals, may harm user computers or organization computer network. If cybercriminals gain access to such applications or deploy them on user computers, they can use functions of such applications to violate security of the user computer or organization computer network.

Such applications include IRC clients, dialers, file download applications, computer system activity monitors, password utilities, Internet servers for FTP, HTTP or Telnet services.

If you want to enable detection of such applications:

1. Do one of the following:
   • Open the application properties window for an individual device.
     1. In the main Kaspersky Security Center Web Console window select Devices → Managed devices.
     2. Select the device.
     3. In the <Device name> window that opens, select the Applications tab.
     4. Select Kaspersky Endpoint Agent.
     5. In the window that opens, select the Application settings tab.
   • Open the policy properties window.
     1. In the main Kaspersky Security Center Web Console window select Devices → Policies and profiles.
     2. Select the policy you want to configure.
     3. In the <Policy name> window that opens, select the Application settings tab.
2. In the Kaspersky Sandbox integration section select the Threat Response subsection.
3. In the Additional group of settings select the Enable detection of legitimate applications that can be exploited by adversaries check box.
4. If you configure the policy settings, in the upper right corner of the group of settings, change the switch from Undefined to Enforce.
5. Click OK.
6. In the policy properties window, click Save.

Page top