Question Hardenining Low Restricted in HIPS

Please provide comments and solutions that are helpful to the author of this topic.
Xeno1234

Xeno1234

Level 14
Thread author
Jun 12, 2023
663
1
1,182
1,266
What should I do to harden "Low Restricted" in HIPS. I have it set to anything not trusted is untrusted, but if there is something I trust, I put it in low restricted.
What should I do to harden specifically low restricted so that programs can function, but also protects against malware.
 
  • Like
Reactions: [correlate], Nevi and vtqhtr413
To harden the "Low Restricted" mode in HIPS, you can do the following:

1. Create a separate rule for each application in Low Restricted mode. This makes it easier to detect and respond to any malicious activities.

2. Only allow the specific actions that are necessary for the application to function. For example, if an application only needs to read files, then deny any attempts to write or execute files.

3. Consider using a whitelist approach and only allowing approved applications to run in Low Restricted mode.

4. Use behavior monitoring to detect any suspicious behavior or deviations from normal application behavior.

5. Keep your Kaspersky software up to date to ensure the latest threat detections are available.
 
  • Like
Reactions: [correlate], Nevi, Zero Knowledge and 2 others
Hum... I find no sense moving apps that You trust to Low Restricted. Anyway Low Restricted group rights and rules by default are selected to let apps run with minimum restrictions, if You change them (harden them), probably some applications will not work properly.
 
Last edited:
  • Like
  • Applause
Reactions: kylprq, micasayyo, brambedkar59 and 8 others
Anyway, You may try these settings:

In Low Restricted group, set to Deny the following rights:
  • Inject code into another process
  • Read memory of another process
  • Access to Windows Account Settings
  • Shutdown Windows
  • Access to camera and microphone
 
  • +Reputation
  • Like
Reactions: Nevi, Trident, Berny and 2 others
harlan4096 said:
Anyway, You may try these settings:

In Low Restricted group, set to Deny the following rights:
  • Inject code into another process
  • Read memory of another process
  • Access to Windows Account Settings
  • Shutdown Windows
  • Access to camera and microphone
Click to expand...
What about System Files. I had everything besides read turned off to stop BYOD attacks that could terminate the AV, and to limit the functionality of Rootkits.
 

You may also like...