Device protection from legitimate applications that can be used by cybercriminals
November 17, 2023
ID 193079
You can enable the detection of legitimate applications that can be used by cybercriminals to harm your organization's local network. Kaspersky Endpoint Agent believes such applications pose threats and performs threat response actions on them accordingly.
Legitimate applications are allowed to be installed and used on devices and are designed to perform user tasks. However, some types of legitimate applications, when used by cybercriminals, may harm an organization's devices or local network. If cybercriminals gain access to such applications or deploy them on devices, they can use the functions of these applications to violate the security of the organization's devices or local network.
These applications include IRC clients, dialers, file download applications, computer system activity monitors, password utilities, and Internet servers for FTP, HTTP or Telnet services.
To enable the detection of legitimate applications:
- Expand the Managed devices node in the Kaspersky Security Center Administration Console tree.
- Select the administration group for which you want to configure application settings.
- Perform one of the following actions in the details pane of the selected administration group:
- To configure application settings for a group of protected devices, select the Policies tab and open the Properties: <Policy name> window.
- To configure the settings of a task or application for an individual protected device, select the Devices tab and go to the settings of a local task or the application settings.
- In the Kaspersky Sandbox integration section select the Threat response subsection.
- In the Additional group of settings select the Enable detection of legitimate applications that can be exploited by adversaries check box.
- In the upper right corner of the settings group, change the switch from Unaffected by policy to Under policy.
- Click Apply and OK.
Detection of legitimate applications that can be used by cybercriminals to harm your organization's local network has been enabled.