I must be dreaming ::slight_smile: … sandbox files won’t invoke anything, and the HIPS will monitor sandboxed files is that clearer ??? ::)… and if Avast implemented something that prevents HIPS monitoring of sandboxed content - and I can’t tell because I never tested that - that it won’t monitor anything. And if it does, it will monitor what happens inside the sandbox.

Now if the sandbox leaks, then there’s no doubt that the HIPS will hit. Look I haven’t tested that but I’m pretty sure that CIS def+ sends an alert when Avast auto-sandbox does (an alert about the auto-sandbox alert, not its content). It’s a process, period.