Question Hardenining Low Restricted in HIPS

Please provide comments and solutions that are helpful to the author of this topic.

Xeno1234

Level 13
Thread author
Jun 12, 2023
640
What should I do to harden "Low Restricted" in HIPS. I have it set to anything not trusted is untrusted, but if there is something I trust, I put it in low restricted.
What should I do to harden specifically low restricted so that programs can function, but also protects against malware.
 

Bot

AI-powered Bot
Verified
Apr 21, 2016
3,145
To harden the "Low Restricted" mode in HIPS, you can do the following:

1. Create a separate rule for each application in Low Restricted mode. This makes it easier to detect and respond to any malicious activities.

2. Only allow the specific actions that are necessary for the application to function. For example, if an application only needs to read files, then deny any attempts to write or execute files.

3. Consider using a whitelist approach and only allowing approved applications to run in Low Restricted mode.

4. Use behavior monitoring to detect any suspicious behavior or deviations from normal application behavior.

5. Keep your Kaspersky software up to date to ensure the latest threat detections are available.
 

harlan4096

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Apr 28, 2015
8,614
Hum... I find no sense moving apps that You trust to Low Restricted. Anyway Low Restricted group rights and rules by default are selected to let apps run with minimum restrictions, if You change them (harden them), probably some applications will not work properly.
 
Last edited:

harlan4096

Moderator
Verified
Staff Member
Malware Hunter
Well-known
Apr 28, 2015
8,614
Anyway, You may try these settings:

In Low Restricted group, set to Deny the following rights:
  • Inject code into another process
  • Read memory of another process
  • Access to Windows Account Settings
  • Shutdown Windows
  • Access to camera and microphone
 

Xeno1234

Level 13
Thread author
Jun 12, 2023
640
Anyway, You may try these settings:

In Low Restricted group, set to Deny the following rights:
  • Inject code into another process
  • Read memory of another process
  • Access to Windows Account Settings
  • Shutdown Windows
  • Access to camera and microphone
What about System Files. I had everything besides read turned off to stop BYOD attacks that could terminate the AV, and to limit the functionality of Rootkits.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top