Issue
- Enhance ransomware protection by creating specific HIPS rules in ESET applications for Windows
- Protect the most sensitive folders or files against unwanted access
Details
Click to expand
A Host-based Intrusion Prevention System (HIPS) monitors system activity and uses a set of pre-defined rules to detect suspicious behavior. When this type of activity is identified, the HIPS self-defense mechanism stops the offending program or process from carrying out the potentially harmful activity.
You can use ESET HIPS to effectively protect most sensitive folders or files against unwanted access:
- Identify folders containing critical sensitive data
- Determine which applications require access to this data
- Block file modification and deletion for all other applications
- Explicitly allow access only for approved applications
This approach should be user-specific and implemented by an experienced administrator who configures HIPS rules to provide strong protection against ransomware, ensuring that only approved applications are allowed to modify or delete critical folders or files.
Read more about configuring additional HIPS rules in ESET business applications or via ESET PROTECT or ESET PROTECT On-Prem or see the HIPS documentation.
Solution
-
Click Settings, select ESET Endpoint for Windows from the drop-down menu. Click Protections → HIPS and click Edit next to Rules.
-
Click Add.
-
Follow the steps below to create Block access and Allow access HIPS rules.
Create the Block access HIPS rule
-
-
Type a rule name and select Block from the Action drop-down menu. Click the toggle next to Target files to enable it. Select the appropriate option from the Logging severity drop-down menu. Click the toggle next to Notify user to enable it, then click Next.
-
Verify that the All applications option is selected from the drop-down menu, then click Next. Click the toggles next to Delete file and Write to file to enable them, and click Next.
-
Select Specific files from the drop-down menu and click Add. In the Add window, type or copy/paste the file path and click OK → Finish.
-
-
-
Type a rule name and select Allow from the Action drop-down menu. Click the toggle next to Target files to enable it. Select the appropriate option from the Logging severity drop-down menu and click Next.
-
Verify that the Specific applications option is selected from the drop-down menu and click Add. In the Add window, type or copy/paste the file path and click OK → Next.
-
Click the toggle next to Delete file, Write to file, and Direct access to disk to enable these options and click Next.
-
Verify that the Specific files option is selected from the drop-down menu and click Add. In the Add window, type or copy/paste the folder or file path and click OK → Finish.
-
-
Review the created rules and click OK.
-
Click the drop-down menu next to Edit and select how HIPS rules defined by this policy will interact with previously defined HIPS rules on the assigned computers. In this example, Replace is selected for both options. Click Finish.
Computers assigned to this policy will receive these new HIPS rules the next time they check into ESET PROTECT or ESET PROTECT On-Prem.
