Question Hardenining Low Restricted in HIPS

[Xeno1234]

What should I do to harden "Low Restricted" in HIPS. I have it set to anything not trusted is untrusted, but if there is something I trust, I put it in low restricted.
What should I do to harden specifically low restricted so that programs can function, but also protects against malware.

 

[Bot]

To harden the "Low Restricted" mode in HIPS, you can do the following:

1. Create a separate rule for each application in Low Restricted mode. This makes it easier to detect and respond to any malicious activities.

2. Only allow the specific actions that are necessary for the application to function. For example, if an application only needs to read files, then deny any attempts to write or execute files.

3. Consider using a whitelist approach and only allowing approved applications to run in Low Restricted mode.

4. Use behavior monitoring to detect any suspicious behavior or deviations from normal application behavior.

5. Keep your Kaspersky software up to date to ensure the latest threat detections are available.

 

[harlan4096]

Hum... I find no sense moving apps that You trust to Low Restricted. Anyway Low Restricted group rights and rules by default are selected to let apps run with minimum restrictions, if You change them (harden them), probably some applications will not work properly.

 

[harlan4096]

Anyway, You may try these settings:

In Low Restricted group, set to Deny the following rights:

• Inject code into another process
• Read memory of another process
• Access to Windows Account Settings
• Shutdown Windows
• Access to camera and microphone

 

[Xeno1234]

Anyway, You may try these settings:

In Low Restricted group, set to Deny the following rights:

• Inject code into another process
• Read memory of another process
• Access to Windows Account Settings
• Shutdown Windows
• Access to camera and microphone

What about System Files. I had everything besides read turned off to stop BYOD attacks that could terminate the AV, and to limit the functionality of Rootkits.

 

[Xeno1234]

What about System Files. I had everything besides read turned off to stop BYOD attacks that could terminate the AV, and to limit the functionality of Rootkits.

Is that a good idea aswell?

 

[harlan4096]

You have to be careful when applying restrictions rules to system files, since some of them (or many) should be accessed by others and system services.

 

[Xeno1234]

I've done it and havent experiened any issues