Advice Request ESET HIPS Rule To Protect a Specific Folder and also to protect the MBR of a Disk??

[Wraith]

Hello everyone. I'm using ESET Internet Security 12 and I have some custom HIPS rules to maximize the protection offered by ESET. Many people here at MT seems to be using ESET. Does anyone know how to create a custom HIPS Rule that would protect the MBR? Also can a custom rule be created to protect a Specified Folder? For example, I created a folder named Important in Documents and inside that folder I have all my document files. I want ESET HIPS to alert me whenever some process tries to delete, modify or create any files inside that particular folder. Any way in which this can be accomplished?

 

[notabot]

Hello everyone. I'm using ESET Internet Security 12 and I have some custom HIPS rules to maximize the protection offered by ESET. Many people here at MT seems to be using ESET. Does anyone know how to create a custom HIPS Rule that would protect the MBR? Also can a custom rule be created to protect a Specified Folder? For example, I created a folder named Important in Documents and inside that folder I have all my document files. I want ESET HIPS to alert me whenever some process tries to delete, modify or create any files inside that particular folder. Any way in which this can be accomplished?

Sounds like you want WD’s Controlled Folder Access and a custom view in the event viewer

Just kidding I don’t know much about ESET as I’ve never used it but you can protect a folder via SRP which should not conflict with ESET (SRP is not part of WD, it’s independent). This may not be the in-ESET solution you seek but may turn out to be handy in case there’s nothing in-product for what you want.

 

[Wraith]

Sounds like you want WD’s Controlled Folder Access and a custom view in the event viewer

Just kidding I don’t know much about ESET as I’ve never used it but you can protect a folder via SRP which should not conflict with ESET (SRP is not part of WD, it’s independent). This may not be the in-ESET solution you seek but may turn out to be handy in case there’s nothing in-product for what you want.

yes you are true about the Controlled Folder Access part. I want an alternative to it since I don't use WD but instead use ESET IS. The Event Viewer part is wrong. I want ESET HIPS to ask me if any program wants to modify the MBR of my disk.

 

[DDE_Server]

this was custom rules made by @viktik

ESET Internet Security 10 : Recommended settings

General Settings HIPS RULE SETTINGS HIPS Alerts FIREWALL INTERACTIVE MODE

malwaretips.com

may be useful

 

[notabot]

yes you are true about the Controlled Folder Access part. I want an alternative to it since I don't use WD but instead use ESET IS. The Event Viewer part is wrong. I want ESET HIPS to ask me if any program wants to modify the MBR of my disk.

Actually SRP won’t be able to help with it either thinking about it better.

As CFA is not an option in your case and given my lack of familiarity with ESET I’ll leave it to others who may have used ESET to help

 

[RoboMan]

Create an HIPS rule to block operation of:

• C:\Windows\System32\wscript.exe
• C:\Windows\System32\cscript.exe
• C:\Windows\SysWOW64\wscript.exe
• C:\Windows\SysWOW64\cscript.exe

on the desired important folder.

PS: no scripts will be able to execute here wether legit or not.

 

[SeriousHoax]

@devjit2018 Did you manage to protect specific folder via Eset HIPS?

 

[Wraith]

@devjit2018 Did you manage to protect specific folder via Eset HIPS?

Nope. ESET does not have a dedicated ransomwares protection module or a dedicated folder protection module.