Comodo D+ - Rules operate at kernel level?

The title pretty much says it all. Do the rules apply at the kernel level? Or userspace? Because if not I'm thinking about going with Win7 Ultimate to get AppLocker to allow/deny rules at the kernel level. Then use D+ to fine tune specifics for the apps. But if D+ operates at kernel level already I'll have less need for AppLocker.

 

I want to say that they operate at the kernel level. Since when it installs it installs kernel drivers. Might want to ask over at the almighty forum or either that or find Rejzor.

 

Yes, I believe that I read a post in their forum that answered at this question, but not sure.

 

http://rce.co/why-usermode-hooking-sucks-bypassing-comodo-internet-security/

CIS answer

https://forums.comodo.com/news-anno...ssing-comodo-internet-security-t84281.15.html

This was in CIS 5, now it should be even better, the HIPS has suffer several improvements and bug fixes, the same for the sandbox