Does SpyShelter 15 protect against code injection?

[SpyShelterCarl]

@RasheedHolland

Use SpyShelter’s powerful “Rules” system to see how the executables on your PC are behaving, then block problematic behavior. For example, executables injecting into other executables, or unexpected changes to sensitive parts of the Windows Registry, and much more. You can even make rules based on publisher, for example you could allow all executable activity from Mozilla, or another publisher you trust.

This was changed/removed. Thanks for reporting the issue so we could get it corrected!

[RasheedHolland]

@SpyShelterCarl

No, I think it only checks the first time SpyShelter runs.

Why did we develop such a feature?

Well, in our Activity list we found it frustrating to see the list of executables and if one had weird behavior we’d have to paste the hash to VT, so instead we made our own system (not VT) so we could easily glance and see if something was marked as “safe” by our own system, or not…

OK cool, so it only checks files once. And it’s basically a second opinion if I understand correctly.

BTW, make sure to check this stuff out about code injection. It’s of course in certain cases a bit hard to protect against all types of code injection, but it’s not impossible to implement detection, without causing many false positives.

ATT&CK® Deep Dive: Process Injection - Red Canary

[SpyShelterCarl]

@RasheedHolland

OK cool, so it only checks files once. And it’s basically a second opinion if I understand correctly.

BTW, make sure to check this stuff out about code injection. It’s of course in certain cases a bit hard to protect against all types of code injection, but it’s not impossible to implement detection, without causing many false positives.

Our team will review this. Thanks for sharing this information so we can improve!

I think we do check the hashes on every launch, not just once. I will double check with our team.

[cborchichi]

Hi Carl,

Could you please check something that I posted today: Notification of binary changed but same hash

Any idea of why this happens?

CB

[SpyShelterCarl]

I’m checking it now with our team. Sorry for the issue. I haven’t experienced this myself or seen it reported before, very strange!

[RasheedHolland]

@SpyShelterCarl

Our team will review this. Thanks for sharing this information so we can improve!

BTW, have you guys already decided on bringing back protection against code injection?

[SpyShelterCarl]

I have just followed up with our developer to see how easy it is to detect/stop again with the latest Windows versions.