SafenSoft: proactive protection against malware and insider threats

Unknown installer launch

Unknown installer – any setup program that does not contain a digital signature from a trusted Certification Authority or that has an expired digital signature.

If an unknown installer launch is attempted, SafenSoft SysWatch suspends the launch and pops up an Alert window. The Alert window has 2 parts:

Execute – the installer and all its modules will be added to the system profile as Trusted.

Execute with checked Run in limited mode – installer will be launched in a sandbox, all malicious activity will be blocked.

Block – block installer from launching. This option is recommended for the applications you don’t trust or for unauthorized launch attempts by those applications.

Block with checked Never run this application in future - block installer from launching and remember the choice.

NOTE

If no decision is made within 5 minutes of the Alert window appearing, the installer will be blocked automatically

NOTE

The Alert window may not appear, if Automatic processing of incidents is enabled.

It is necessary to set Delayed Decision in the Incident management window for the Alert window to appear in the case of security incidents.
 

NOTE

If the installer has a valid digital signature from a trusted Certification Authority, it will be executed in Install mode automatically.

Actions

Allow launch of unknown installer

Block launch of unknown installer and remember this selection