Kaspersky Embedded Systems Security 3.4 for Windows

Selecting the mode of the Applications Launch Control task

To configure the mode of the Applications Launch Control task:

1. Open the Task settings window.
2. On the General tab, in the
   Task mode

   

   In this drop-down list you can select an Applications Launch Control task mode:

   • Active. Kaspersky Embedded Systems Security for Windows uses the specified rules to control any applications that are launched.
   • Statistics only. Kaspersky Embedded Systems Security for Windows does not use Applications Launch Control rules. It only records information about the start of applications in the task log. All applications are allowed to start. You can use this mode to generate a list of Applications Launch Control rules based on the information about blocking recorded in the task log.

   By default, the Applications Launch Control task runs in Statistics only mode.

   drop-down list, specify the task mode.
3. Clear or select the
   Repeat action taken for the first file launch on all the subsequent launches for this file

   

   The check box enables or disables launch control for the second and subsequent attempts to start applications based on the event information stored in the cache.

   If the check box is selected, Kaspersky Embedded Systems Security for Windows allows or denies subsequent launches of an application based on the task's conclusion regarding the first launch of the application. For example, if the first application launch was allowed by the rules, information about this decision will be stored in the cache, and the second and all subsequent launches will also be allowed without rechecking.

   If the check box is cleared, Kaspersky Embedded Systems Security for Windows analyzes an application every time a launch is attempted.

   By default, the check box is cleared.

   check box.

   Kaspersky Embedded Systems Security for Windows creates a new list of cached events every time the Applications Launch Control task settings are modified. This means that Applications Launch Control is performed according to the current security settings.

4. Clear or select the
   Deny the command interpreters launch with no command to execute

   

   If the check box is selected, Kaspersky Embedded Systems Security for Windows denies the launch of command line interpreters even if launching interpreters is allowed. A command line interpreter can only be launched with no command if both of the following conditions are met:

   • Launch of the command line interpreter is allowed.
   • The command to be executed is allowed.

   If the check box is cleared, Kaspersky Embedded Systems Security for Windows only considers allowing rules when launching a command line interpreter. The launch is denied if no allowing rule applies or the executable process is not trusted by KSN. If an allowing rule applies or the process is trusted by KSN, a command line interpreter can be launched with or without a command to execute.

   Kaspersky Embedded Systems Security for Windows recognizes the following command line interpreters:

   • cmd.exe
   • powershell.exe
   • python.exe
   • perl.exe

   By default, the check box is cleared.

   .
5. Click the OK button in the Task settings window.

The specified settings are saved.

All attempts to start applications are recorded in the task log.