Serious Discussion ESET PROTECT (endpoint) doesn't have LiveGuard, but PREMIUM does

ESET
19 Replies 1,956 Views
Victor M said:
I just found out that ESET Protect (Endpoint version) does NOT have LiveGuard, but ESET Premium does.

My hypothesis is that Protect ( Endpoint business ) is the slow but sure edition, whereas Premium is the Latest Greatest edition.
Click to expand...
Hey Victor M,

You're spot on that LiveGuard isn't part of the standard ESET PROTECT Endpoint offerings—it's more of a consumer-side feature in products like ESET Smart Security Premium. From what I've seen, the business editions (like ESET Endpoint Security) lean on similar tech through ESET Dynamic Threat Defense, which is an optional add-on. It provides cloud-based sandboxing and analysis for suspicious files, kinda like LiveGuard but tailored for enterprise environments with centralized management.

As for your hypothesis: I'd say it's not exactly "slow but sure" vs. "latest greatest." The business line (Endpoint via PROTECT) is built for scalability, compliance, and admin control, so it prioritizes stability and integration over bleeding-edge consumer features. Premium is more about individual users getting the newest bells and whistles right away. If you're comparing for a specific setup, what are you using it for—home or work? Might help narrow down recommendations.

Cheers!
 
Victor M said:
I just found out that ESET Protect (Endpoint version) does NOT have LiveGuard, but ESET Premium does.

My hypothesis is that Protect ( Endpoint business ) is the slow but sure edition, whereas Premium is the Latest Greatest edition.
Click to expand...
It is only in Eset Proect Advanced and higher editions.
Eset Protect Entry hasn’t got it.
It’s available as a paid add-on as well.
 
Trident said:
Why don’t you try Check Point Harmony?

That has emulation too.
Click to expand...
I sorta like Eset because it has HIPS rules. Thats because I don't trust automated detection too much.( see your CT inbox )
I hope it can analyze and detect even metasploit hosted C2's ( not just the big campaign ones)
 
Last edited:
Victor M said:
I hope to find something that can detect metasploit hosted C2's.

ESET has application control too. I saw it in my SIEM.
Click to expand...
This is an IPS matter. You can have a look at enabling SNORT/Suricata on a router level.

Also effective are the anti-bot solutions which usually combine network heuristics (unusual ports, protocols, reputation) with behavioural heuristics which can detect the beaconing.

Last but not least, solutions that inspect certificates can also help to detect self-signed certs.

So the best solutions for you:
Bitdefender, Kaspersky, Check Point and Avast use very efficient anti-bot monitoring fitting the description above.
Bitdefender also inspects the certificates.

I would leave Avast out as behavioural monitoring is not as good as the other 3 solutions suggested.
 
Zero Knowledge said:
It's 2025 and your still worried about metasploit? Why? I would focus on Cobalt Strike if your going to focus on anything to do with attack frameworks.
Click to expand...
Against Cobalt Strike, most network protections are reactive/ephemeral.

The best defence there is behavioural inspection on the machine, memory scanning as well as solutions like LiveGuard.
 
Let's be real, when it comes to hitting your security targets, Suricata is simply money. It detects and stops encrypted Cobalt Strike C2 traffic effectively without needing to break the encryption open. Why? Because it focuses on passive metadata extraction. That's the key to how it works with any encrypted traffic.

The primary mechanism is all about TLS/SSL fingerprinting, JA3 and JARM are key here. This process analyzes the initial ClientHello packet fields, the cipher suites, the extensions, the elliptic curve formats. This generates a precise, non-changing hash of the Beacon implant software, which is basically the C2 payload calling home. Suricata then matches this fingerprint against known malleable C2 profiles and can block the connection entirely. This is huge because Cobalt Strike cannot randomize the order of those fields without breaking the TLS handshake. Suricata also hunts for suspicious patterns in the network traffic, like consistent beaconing to known malicious infrastructure or dodgy certificate issuers.

In IPS mode, Suricata actively drops bad packets or resets connections the second it detects them. While deep payload inspection still needs a separate decryption proxy, Suricata's effectiveness is entirely dependent on having updated rules and, well, or rather, on getting the tuning right for your specific environment. It offers both reactive detection (IDS) and proactive prevention (IPS) capabilities against C2 activity, which means we're golden.
 
Victor M said:
Yes, I do have suricata on my Netgate.
Click to expand...
You will not be needing Suricata as from my understanding you have blocked the execution of various LOLBins and if my recommendations were followed, others are blocked from connecting.

This makes downloading and injecting the payload more difficult and the beacon connection is blocked.

Furthermore, the source can be emulated by Eset LiveGuard and any hidden dangers can be blocked, which again makes the payload impossible to download and activate.

The IPS and anti-bot protections are reactive once the attacker has already performed the initial compromise.

Eset is now in the process of rolling out email scanner as well which can remove spam and scam with malicious payloads.
 

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top