Reply to thread

Message

<blockquote data-quote="davisd" data-source="post: 820973" data-attributes="member: 77647">The people asking for wildcard support in HIPS goes way back to like 5+ years ago already, still not available, it&#039;s ridiculous. I believe they don&#039;t want to do it, since more and more other AV products go stupidly-simple-mode, without user intervention needed when threats are found, as statistics say globally, people make wrong decisions answering on prompts etc, so I doubt they are going to make Eset more complex in advanced settings which you can configure already, lets not forget Eset is just an &quot;Antivirus&quot;, so it was never meant to make these type of crazy HIPS rules, but only AV suite which I can think of can be configured to archieve this type of system lockdown is Kaspersky. Every Eset user wanting to play with HIPS is just 3-4 clicks away of completely bricking their system as making too generic rule you won&#039;t be able to boot, notifications goes 800+ in few seconds, and all system just crash, so percentage of failure rate making wrong rules is very high, and Eset forums would go totally bonkers.I don&#039;t really like Eset suggestions of ransomware protection by making &quot;child proccess&quot; denial rules, but they are meant for business products, so. I don&#039;t really know what vuln list ERP has, I have my own made over time, but I believe every rule and line must be specifically adjusted for each user system accordingly, to not brake the systems functionality depending on the user needs and programs used daily. For regular home users, one can deny most commonly abused, like wscript, cscript, powershell, etc. ~5-10 rules in Eset HIPS which is not hard, by greatly reducing attack chain vectors.</blockquote>

[QUOTE="davisd, post: 820973, member: 77647"] The people asking for wildcard support in HIPS goes way back to like 5+ years ago already, still not available, it's ridiculous. I believe they don't want to do it, since more and more other AV products go stupidly-simple-mode, without user intervention needed when threats are found, as statistics say globally, people make wrong decisions answering on prompts etc, so I doubt they are going to make Eset more complex in advanced settings which you can configure already, lets not forget Eset is just an "Antivirus", so it was never meant to make these type of crazy HIPS rules, but only AV suite which I can think of can be configured to archieve this type of system lockdown is Kaspersky. Every Eset user wanting to play with HIPS is just 3-4 clicks away of completely bricking their system as making too generic rule you won't be able to boot, notifications goes 800+ in few seconds, and all system just crash, so percentage of failure rate making wrong rules is very high, and Eset forums would go totally bonkers. I don't really like Eset suggestions of ransomware protection by making "child proccess" denial rules, but they are meant for business products, so. I don't really know what vuln list ERP has, I have my own made over time, but I believe every rule and line must be specifically adjusted for each user system accordingly, to not brake the systems functionality depending on the user needs and programs used daily. For regular home users, one can deny most commonly abused, like wscript, cscript, powershell, etc. ~5-10 rules in Eset HIPS which is not hard, by greatly reducing attack chain vectors. [/QUOTE]

Verification