[KB7249] Create a HIPS rule and enforce it on a client workstation in ESET endpoint products

The Host-based Intrusion Prevention System (HIPS) monitors events inside the operating system and reacts accordingly based on a set of pre-defined rules to recognize suspicious system behavior. When this type of activity is identified, the HIPS self-defense mechanism stops the offending program or process from carrying out a potentially harmful activity. Additional HIPS rules can be defined manually by the user.

ESET PROTECT On-Prem users: Perform these steps in ESET PROTECT On-Prem

1. Open the main program window of your Windows ESET product.

2. Press the F5 key to access Advanced setup.

3. Click Detection Engine → HIPS and then click Edit next to Rules.

4. Click Add.

5. Configure your rule. In this example, we are blocking operations affecting applications and the user will be notified of the action. Click Next.

6. In the Source applications window, select your desired option from the drop-down menu. In this example, the HIPS rule will block any application that attempts to modify registry values. Click Next.

7. In the Application operation window, click the toggle to enable it next to the operations you want to block. In this example, the HIPS rule will block any application that attempts to debug another application. Click Next.

8. In the Applications window, select your desired option from the drop-down menu. In this example, the rule will apply to all applications. Click Finish.

9. Click OK → OK. Restart your Windows operating system for the changes to take effect.