- Jun 24, 2016
- 2,501
Good morning mortals! I hereby share with you some amazing HIPS rules for ESET that will work as default-deny to prevent infections such as ransomware. You can check the source here.
You can test under your own risk. I have enabled them all with ESET Internet Security 19 and it works flawlessly, feeling no need for extra companion software.
To start with, head to HIPS module under settings, and click EDIT button.
IMPORTANT: create a system restore point before making these changes, just in case.
Figure 2-1
Figure 2-2
Figure 2-3
Figure 2-4
Figure 2-5
Click the image to view larger in new window
Leave the HIPS rules window open and continue to the next section.
Figure 3-1
Figure 3-2
Figure 3-3
Figure 3-4
Figure 3-5
Leave the HIPS rules window open and continue to the next section.
Figure 4-1
Figure 4-2
Figure 4-3
Figure 4-4
Figure 4-5
Leave the HIPS rules window open and continue to the next section.
Figure 5-1
Figure 5-2
Figure 5-3
Figure 5-4
Figure 5-5
Leave the HIPS rules window open and continue to the next section.
Figure 6-1
Figure 6-2
Figure 6-3
Figure 6-4
Figure 6-5
Leave the HIPS rules window open and continue to the next section.
Figure 7-1
Figure 7-2
Figure 7-3
Figure 7-4
Figure 7-5
Figure 7-6
The whole configuration file (including these HIPS rules and the mentioned rules in Q&A - Configure ESET Antivirus for Maximum Security (by RoboMan)) can be downloaded here: UPLOAD.EE - eset_19.xml - Download
You can test under your own risk. I have enabled them all with ESET Internet Security 19 and it works flawlessly, feeling no need for extra companion software.

To start with, head to HIPS module under settings, and click EDIT button.
IMPORTANT: create a system restore point before making these changes, just in case.
1. Click Add, and type “Deny child processes from script executables” into the Rule name field.
Figure 1-2
Figure 1-3
Figure 1-4
Figure 1-5
Leave the HIPS rules window open and continue to the next section.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (Warning)
- Notify user

Figure 1-2
- Click Next and in the Source applications window, click Add and type in the following names, clicking OK and then Add after each one:
- C:\Windows\System32\wscript.exe
- C:\Windows\System32\cscript.exe
- C:\Windows\SysWOW64\wscript.exe
- C:\Windows\SysWOW64\cscript.exe
- C:\Windows\System32\ntvdm.exe

Figure 1-3
- Click Next, click the slider bar next to Start new application to enable it and then click Next.

Figure 1-4
- Select All applications from the drop-down menu and click Finish.

Figure 1-5
Leave the HIPS rules window open and continue to the next section.
- In the HIPS rules window, click Add.

Figure 2-1
- Type “Deny script processes started by explorer” into the Rule name field.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (Warning)
- Notify user

Figure 2-2
- In the Source applications window, click Add, type “C:\Windows\explorer.exe” into the Specify file pathfield and then click OK. Click Next.

Figure 2-3
- In the Application operations window, click the slider bar next to Start new application to enable it. Click Next.

Figure 2-4
- Click Add and in the Applications window, click Add and type in the following process names, clicking OK and then Add after each one:
- C:\Windows\System32\wscript.exe
- C:\Windows\System32\cscript.exe
- C:\Windows\SysWOW64\wscript.exe
- C:\Windows\SysWOW64\cscript.exe
Click Finish.

Figure 2-5
Click the image to view larger in new window
Leave the HIPS rules window open and continue to the next section.
- In the HIPS rules window, click Add.

Figure 3-1
- Type “Deny child processes from Office 2013 processes” into the Rule name field.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (warning)
- Notify user

Figure 3-2
- In the Source applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Program Files\Microsoft Office\Office15\WINWORD.EXE
- C:\Program Files\Microsoft Office\Office15\OUTLOOK.EXE
- C:\Program Files\Microsoft Office\Office15\EXCEL.EXE
- C:\Program Files\Microsoft Office\Office15\POWERPNT.EXE
- C:\Program Files (x86)\Microsoft Office\Office15\WINWORD.EXE
- C:\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE
- C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE
- C:\Program Files (x86)\Microsoft Office\Office15\POWERPNT.EXE

Figure 3-3
- In the Application operations window, click the slider bar next to Start new application to enable it. Click Next.

Figure 3-4
- In the Applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Windows\System32\cmd.exe
- C:\Windows\SysWOW64\cmd.exe
- C:\Windows\System32\wscript.exe
- C:\Windows\SysWOW64\wscript.exe
- C:\Windows\System32\cscript.exe
- C:\Windows\SysWOW64\cscript.exe
- C:\Windows\System32\ntvdm.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\System32\regsvr32.exe
- C:\Windows\SysWOW64\regsvr32.exe
- C:\Windows\System32\rundll32.exe
- C:\Windows\SysWOW64\rundll32.exe
- 2016 = Office16
- 2010 = Office14

Figure 3-5
Leave the HIPS rules window open and continue to the next section.
- In the HIPS rules window, click Add.

Figure 4-1
- Type “Deny child processes for regsrv32.exe” into the Rule name field.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (warning)
- Notify user

Figure 4-2
- In the Source applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Windows\System32\regsvr32.exe
- C:\Windows\SysWOW64\regsvr32.exe

Figure 4-3
- In the Application operations window, click the slider bar next to Start new application to enable it. Click Next.

Figure 4-4
- In the Applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Windows\System32\cmd.exe
- C:\Windows\SysWOW64\cmd.exe
- C:\Windows\System32\wscript.exe
- C:\Windows\SysWOW64\wscript.exe
- C:\Windows\System32\cscript.exe
- C:\Windows\SysWOW64\cscript.exe
- C:\Windows\System32\ntvdm.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Figure 4-5
Leave the HIPS rules window open and continue to the next section.
- In the HIPS rules window, click Add.

Figure 5-1
- Type “Deny child processes for mshta.exe” into the Rule name field.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (warning)
- Notify user

Figure 5-2
- In the Source applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Windows\System32\mshta.exe
- C:\Windows\SysWOW64\mshta.exe

Figure 5-3
- In the Application operations window, click the slider bar next to Start new application to enable it. Click Next.

Figure 5-4
- Select All applications from the drop-down menu and click Finish.

Figure 5-5
Leave the HIPS rules window open and continue to the next section.
- In the HIPS rules window, click Add.

Figure 6-1
- Type “Deny child processes for rundll32.exe” into the Rule name field.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (warning)
- Notify user

Figure 6-2
- In the Source applications window, click Add and type in the following file name:
- C:\Windows\System32\rundll32.exe

Figure 6-3
- In the Application operations window, click the slider bar next to Start new application to enable it. Click Next.

Figure 6-4
- In the Applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Windows\System32\cmd.exe
- C:\Windows\SysWOW64\cmd.exe
- C:\Windows\System32\wscript.exe
- C:\Windows\SysWOW64\wscript.exe
- C:\Windows\System32\cscript.exe
- C:\Windows\SysWOW64\cscript.exe
- C:\Windows\System32\ntvdm.exe
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Figure 6-5
Leave the HIPS rules window open and continue to the next section.
- In the HIPS rules window, click Add.

Figure 7-1
- Type “Deny child processes for powershell.exe” into the Rule name field.
- From the Action drop-down menu, select Block.
Enable the following options:- Applications
- Enabled
- Logging severity (warning)
- Notify user

Figure 7-2
- In the Source applications window, click Add and type in the following file names, clicking OK and then Add after each one:
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Figure 7-3
- In the Application operations window, click the slider bar next to Start new application to enable it. Click Next.

Figure 7-4
- Select All applications from the drop-down menu and click Finish.

Figure 7-5
- When finished adding HIPS rules, click Finish to save the policy settings.

Figure 7-6
Last edited: