Advice Request Good HIPS software

[vuksha_xc60]

Hello,
I need recommendation for good HIPS - only software to use.
I use Comodo Internet Security on my PC. It runs well, but when I need to test something quickly in a VM it's not that practical to install the whole suite just for one function.
What do you recommend ?

Guest OS: Windows 10 Pro
Hypervisor(s): VMware Player 16
RAM: 4GB
CPU Cores: 2

 

[sepik]

Hello,
Spyshelter Free comes to mind. Premium(paid) version offers more protection.

Kind regards,
-sepik

 

[Jan Willy]

Search on the forum for experiences with SpyShelter (free). Simple and light app.
Edit:
I've posted this before I had seen sepik's message.

 

[ichito]

Hello,
Spyshelter Free comes to mind. Premium(paid) version offers more protection.

Kind regards,
-sepikeatures

Yes...SS Free is the excellent successor of apps from "golden era" of HIPS. Premium has much more features but Firewall version has useful option to manage parent/child processes.

 

[Kongo]

ReHIPS is quite decent. But if you are looking for a free option, then go with SpyShelter Free as mentioned above.

 

[Chuck57]

ReHIPS is very good, if you can get past the learning curve. There's actually a lot of information on their site that covers just about everything. Haven't heard anything out of them in a couple of years, but the forum still gets responses to posts, so I guess Re HIPS is still alive.

 

[Tutman]

NO update since 2018. ReHIPS

ReHIPS 2.4.0 release

2018-06-27 12:49:25 UTC+3

 

[Kongo]

NO update since 2018. ReHIPS

ReHIPS 2.4.0 release

2018-06-27 12:49:25 UTC+3

I should say it was decent when i last tested it, my bad

 

[ichito]

ReHIPS is a normal HIPS only by name...from its page
"Unlike some other sandboxes ReHIPS doesn't use kernel-mode hooks, splicing and other unsafe rootkit-techniques. It is based on documented Windows security mechanisms ensuring system stability."
Actually all action of sandboxed process are limited automatically and not monitored/alerted...in result we can't create rules like in classical HIPS.

 

[SearchLight]

I have paired Kaspersky Security Cloud Free with SSFree based on what I have read here at MT to compensate for KSCFree lack of Application Control.

So far they coexist nicely, plus you get a two way application firewall to supplement Windows'.

 

[Zartarra]

On one system I have Microsoft Defender configured with GPO's and ReHips (modified to block/ask for LoLBins). In the logs I get the following alert for Microsoft Defender:

Have anyone else with the same issue?

 

[SeriousHoax]

On one system I have Microsoft Defender configured with GPO's and ReHips (modified to block/ask for LoLBins). In the logs I get the following alert for Microsoft Defender:

View attachment 258614

Have anyone else with the same issue?

This ASR can give false positives sometimes. I have experienced this with another program. @Andy Ful might be able to give you a better answer.

 

[Andy Ful]

On one system I have Microsoft Defender configured with GPO's and ReHips (modified to block/ask for LoLBins). In the logs I get the following alert for Microsoft Defender:

View attachment 258614

Have anyone else with the same issue?

This rule can make a lot of noise in the Defender Security Log. Most of the blocked events are usually false positives when the legal application tries to enumerate running processes and attempts to open them with exhaustive permissions. These applications can be excluded by using <Manage ASR Exclusions>.

 

[Zartarra]

Thanks for the explanation.