- Apr 28, 2015
- 8,948
It seems scripts detections did not improve even hardening the settings...
ESET IS - April 2021 Report
- Thread starter harlan4096
- Start date
Yeah ESET's advanced techniques (more static heuristics, possibly sandbox emulation on-device) do tend to be heavy. Both involve more analysis before the program is even allowed to run, which I think most users perceive as a slowdown. A behavior blocker traps and evaluates API calls which happen less often and most apps when they are doing CPU-intensive things are not calling out to Windows APIs constantly.I have felt a slight impact especially when launching a program with these more aggressive settings
That's too bad. Once again, "SM25.vbs" seems to have identically duplicated itself and then put that script into AutoRuns.... I can't imagine a behavior blocker would miss that. From the Huorong test:
I think for most people, ESET should be left at the default settings. Maybe turning on advanced DNA signatures would be interesting because we have seen some impressive ML detections from ESET before. The aggressive settings and their performance impacts don't justify the marginal improvement in protection.
- Apr 28, 2015
- 8,948
I already turned on that DNA hehe... see the pics in my previous post...
Nice!
Yeah against scriptors especially, signatures are a losing game. When ESET was actively adding signatures for my PoCs, I found a meaningless Python syntax change was enough to break detection: #45 and Malware analysis - "pyrate", Behavior Blocker Bypass POC #3 ... and that's not even really trying. There's just way too many ways in a script to obfuscate your intentions from static inspection. With compiled executables, the way the compiler organizes and optimizes code leaves behind a lot more unique signatures you can latch on to.
- Apr 28, 2015
- 8,948
A small test (to make ESET fans happy 
) performed today with a high detected sample but not detected by ESET at VT "apparently":
) performed today with a high detected sample but not detected by ESET at VT "apparently":
Last edited:
- May 3, 2015
- 1,760
The fact a sample is not detected by an engine on VT does not mean it doesn't actually detect it. That is a well-known fact many people keep forgetting.
- Apr 1, 2019
- 2,868
You are a champ. Thanks for satisfying our curiosity.A small test (to make ESET fans happy
View attachment 256723
View attachment 256722
View attachment 256719
View attachment 256720
View attachment 256721
Thanks @upnorth for the sample...
- Apr 28, 2015
- 8,948
I know, that's why I said "apparently"... this time was "right" since it was not detected on demand but was on dynamic
- Apr 28, 2015
- 8,948
Hi guys, for the rest of the month I've just implemented:
[KB6119] Configure HIPS rules for ESET business products to protect against ransomware
[KB6132] Configure firewall rules for ESET Endpoint Security to protect against ransomware
Also keeping the previous aggressive tweaks...
[KB6119] Configure HIPS rules for ESET business products to protect against ransomware
[KB6132] Configure firewall rules for ESET Endpoint Security to protect against ransomware
Also keeping the previous aggressive tweaks...
- Jun 11, 2019
- 408
Why didn't you add my suggestions for rules to hips in addition to the settings recommended by the antivirus developers?
Last edited:
- Apr 28, 2015
- 8,948
The surprising thing is that at this point, We still have to add manually those entries in HIPS to stop/block scripts, java rats and others threats creating their entries and infect the system...
In recent tests, ESET was able to detect/remove only 2 entries in Windows AutoRuns sections (in 2 different tests), but still remained other additional ones, and those 2 detections took place after the system restart, when the system was already infected...
Where is ESET BB...?
In recent tests, ESET was able to detect/remove only 2 entries in Windows AutoRuns sections (in 2 different tests), but still remained other additional ones, and those 2 detections took place after the system restart, when the system was already infected...
Where is ESET BB...?
- Apr 1, 2019
- 2,868
A very good question, it must take a really long time to download and it just isn't there yet...
Ransomware Shield | ESET Glossary
Ransomware Shield is a behavior-based detection technique that monitors behavior of applications and processes that try to modify files in the way common for...
What drives me nuts is that ESET advertises that their product does have a behavior blocker for ransomware behavior at least. Also "Deep Behavioral Inspection" since 2019:
This is describing a behavior blocker, specifically calling out "Registry Events". To date I've never seen any of these features activate, either personally or in a Malware Hub test. The only dynamic detections I've seen are the "<signature> was found in a file downloaded/opened by <process>" which is basically just signature scanning during execution.
If you have a behavior blocker, it's really unlikely that it'd let a file copy itself then add to AutoRuns. I tested this against several AV software earlier: Homebrewed Zero Day behavior blocker test
- Oct 1, 2019
- 303
I would like to ask to implement ESET setting to test them as mentioned on my previous reply about ESET recommended settings. Which you just need to import the file to ESET.
Kindly refer to post here:
Q&A - ESET - Recommended Settings
Kindly refer to post here:
Q&A - ESET - Recommended Settings
- Apr 28, 2015
- 8,948
It seems that was for version 2019 of ESET... so to avoid possible compatibility issues I implemented manually the settings from the 2 official ESET links...
- Oct 2, 2020
- 455
It seems that those HIPS rules break some ransomware installation process.
I hope that ESET decides to add some of them in built-in (hidden) rules.
I hope that ESET decides to add some of them in built-in (hidden) rules.
- Apr 28, 2015
- 8,948
Adding by default those HIPS rules can be problematic, because They can break also legit behavior ...
- Oct 2, 2020
- 455
Yes I agree. For most users they might not be problematic but some software might be blocked. That's why I prefer to set them to Ask when creating them.
- May 3, 2015
- 1,760
ESET could have many preset HIPS rules with a simple on/off switch. The rules could be even automatically turned on/off according to how paranoid you set it. As it is, the HIPS is basically useless for a basic user and demand some work for advanced users.
- Jan 27, 2019
- 103
I still can't get my head around having to fiddle with HIPS settings in Eset.
Beyond my level of expertise, and I wish Eset would come up with some preset rules rather than the Auto option ?
Similar threads
