Trying out Sandboxie - Help Needed

I would like to test Sandboxie and give it a try in portable mode, but I've already run into a problem with Hitman Pro Alert. I'm probably misunderstanding something somewhere, but I cannot start Firefox from a sandbox without HMPA interfering. To continue, I tried turning off mitigations for Sandboxie in HMPA, but I still get an Attack Intercepted alert (Sandboxie COM services). A beginners question: What is the proper way to avoid this from happening so I can continue testing?

Spoiler

Code:

Mitigation   PrivGuard
Timestamp    2022-07-28T11:01:53

Platform     6.1.7601/x86 v945 06_4e
PID          3624
Application  U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SandboxieRpcSs.exe
Created      2022-07-28T09:51:06
Description  Sandboxie COM Services (RPC) 5.57.6

Local Privilege Escalation detected

Code Injection
00060000-00061000    4KB U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SbieSvc.exe [5564]
00070000-00071000    4KB
77533000-77534000    4KB
1  U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SbieSvc.exe [5564]
2  C:\Windows\System32\services.exe [752]
3  C:\Windows\System32\wininit.exe [704]
   wininit.exe

Process Trace
1  U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SandboxieRpcSs.exe [3624]
2  U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SbieSvc.exe [5564]
3  C:\Windows\System32\services.exe [752]
4  C:\Windows\System32\wininit.exe [704]
   wininit.exe

Services
5564  SbieSvc

Dropped Files
1  U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\Sandboxie-9112392.tmp
     Dropped by \Device\HarddiskVolume8\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SbieSvc.exe [5564]
2  U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\Sandboxie-9112985.tmp
.
.
.
.
24 U:\SwApps\Thin\SandBoxie+\Sandboxie-Plus\Sandboxie-9117260.tmp
     Dropped by \Device\HarddiskVolume8\SwApps\Thin\SandBoxie+\Sandboxie-Plus\SbieSvc.exe [5564]

Thumbprints
b341ba81e6dc59ab8f5be68a6535ffe7e2fe010eab919ca598bdf460dac78465

 

Perhaps adding this line to your firefox sandbox settings (DefaultBox?) might help (if not already present):

Code:

[DefaultBox]
.
.
Template=HitmanProAlert

The option to edit sandboxie.ini (where this setting goes) is in the GUI

 

Unfortunately, adding that did not change anything.

 

I'm assuming you deleted the contents of the sandbox before starting firefox sandboxed again.
I do not use HitmanPro. Hopefully, others who do will chime in.

 

What is your sandboxie plus version?

 

1.2.6

I tried deleting the content as you mentioned, but that had no effect either.

 

Your version is the current latest. One other thing to try is to
add "SandboxieLogon=n" (or change from y to n) in the
[Global Settings] of sandboxie.ini, reboot and try again.

 

I found a solution to get Firefox to launch.

Instead of disabling Exploit mitigations for Sandboxie in HMPA, went to Risk Reduction > Process Protection > uncheck Local Privilege Mitigation.

Not sure though what the risks are disabling this function.

 

Yes correct, this is the only way to fix this, since HMPA hasn't implemented a whitelist, so it basically sees Sandboxie as malware. The risk is that malware might still elevate priviliges if it manages to run in the first place.