Serious Discussion iDefender

NormanF

Level 9
Verified
Jan 11, 2018
404
The company was renamed Trusing.

The translation offers an explanation of their HIPS software:

The difference between iDefender and other HIPS software

People often ask, what is the difference between iDefender and other HIPS software, and why choose iDefender instead of other security software.

iDefender breaks the traditional object-based operation protection model (such as file addition, deletion, modification, reading and other operation defense), adopts an innovative rule model based on scenario mode (such as prohibiting process startup, document protection, privacy protection), and designs. The rules engine based on templates + parameters greatly reduces the difficulty of editing defense rules. It also provides a rules market, making the sharing and acquisition of rules within easy reach.

In terms of performance, the iDefender rule engine adopts double cache mode, which improves the matching efficiency to the extreme. There is almost no performance consumption on the system without setting the rules incorrectly. There will be no memory growth or cumulative performance consumption during long-term operation. It is not only suitable for personal computers, but also for cloud servers.

iDefender completely uses the standard kernel API recommended by Microsoft to implement its functions. It has good compatibility and can coexist well with other security software.
 
Last edited:

B-boy/StyLe/

Level 3
Thread author
Verified
Well-known
Mar 10, 2023
147
Have you thought of writing some additional rules for iDefender HIPS to make it more robust? Worth looking into. It should be tweakable with custom rules.
Sound like a good idea. However, with my new job I rarely have the time to test and actively participate in malware analysis or security products reviewing, unfortunately. I am still actively submitting bugs to be fixed to various software and game developers tho and reporting missing malware samples to many security vendors, but still not like in my active/prime years ten years ago. :) But will try my best if I have more spare time to do so.
 

NormanF

Level 9
Verified
Jan 11, 2018
404
Sound like a good idea. However, with my new job I rarely have the time to test and actively participate in malware analysis or security products reviewing, unfortunately. I am still actively submitting bugs to be fixed to various software and game developers tho and reporting missing malware samples to many security vendors, but still not like in my active/prime years ten years ago. :) But will try my best if I have more spare time to do so.

A package of additional rules would make it stronger like the one a poster here compiled for Huorong Internet Security. A desideratum for the future.
 

B-boy/StyLe/

Level 3
Thread author
Verified
Well-known
Mar 10, 2023
147
Version 4.0 released. A lot of new features including a sandbox

Lol, this is a huge update with a lot of major changes. This version needs to be re-tested by @cruelsister and @Shadowra. :)
With Google Translate:
Major version update, it is recommended to update
Imonitorsdk update to 4.0
Add kernel rules engine
Add file hidden support
Add sandbox support
Add RPC call process traceability
Optimize some performance

template
Add built-in rules template
Add advanced template (kernel mode) support
Add file hidden template
Add lightweight sandbox template
Add domain name query template

Enhance defense
Add analog mouse keyboard monitoring
Add access to cut plate monitoring
Add a modification system time monitoring
Add key event monitoring
Add to modify desktop background monitoring
Add disk control monitoring
Inquiry bomb frame
Add signature information display
Add event customization
The bomb box response record supports the cache (the same event is not reminded by the same event by default, you can set it in the settings)
Intercept record
Add pagination support
Trust list
Support parameter array

optimization
Optimize the rules parameter settings
The disclosure part of the expired template
Optimize kernel process list performance
Add Image Holding Protection
Enhance self -protection logic
Add remote call traceability (service creation, driver loading, task plan, user creation, DNS query, etc. can be positioned to the source)
Add kernel level rules settings
Add WMI process to create monitoring
The rules group supports the introduction of shear plates
Parameter supports drag movement position

repair
Add the compatibility of the network filter driver
Optimize HKEY_CLASSSES_ROOT to redirect
Fix the error
 
  • Like
Reactions: harlan4096

lvseqiji

Level 2
Mar 30, 2022
71
Version 4.3.0.0 out
### 4.3.0.0 Update Log

#### iMonitorSDK
- Added ICMP scan monitoring
- Added process protection
- Added shortcut parsing
- Added MoveFileEx monitoring support (delete files on reboot)
- Added more screenshot support: covering AntiTest
- Fixed issue where 8.3 short path caused rule matching to fail
- Fixed issue where SYSTEM process was being bypassed
- Fixed issue where shared file operations were not being monitored
- Fixed issue where port 445 could not be intercepted

#### Features
- Added intelligent defense rules (cloud based)
- Added support for learning mode
- Added workspace support
- Refined file operation prompts
- Display multi-line strings in registry

#### Templates
- Added commonly used template directory
- Renamed file and added suffix field for repair
- Added shortcut interception

#### Others
- Optimized interception record display
- Added built-in rules for system process spoofing
- Interception popup now supports partial sub-window interception
- Registry startup interception does not block normal installation
- Fixed issue where installation failed on some server systems
- Fixed issue where rule overrides did not clear the trust list
download: https://trustsing.com/publish/iDefender.exe
 

harlan4096

Super Moderator
Verified
Staff Member
Malware Hunter
Well-known
Apr 28, 2015
8,958
This tool is getting detected by KES:

Event: Legitimate software that can be used by intruders to damage your computer or personal data was detected
User type: Initiator
Component: File Threat Protection
Result description: Detected
Type: Legitimate software that can be used by intruders to damage your computer or personal data
Name: not-a-virus:HEUR:Monitor.Win32.Agent.gen
Precision: Heuristic Analysis
Threat level: Low
Object type: File
Object name: iDefender.gU5hMGAX.exe.part
SHA256 of an object: BAA3F8D12047C76EC0875440C3C57D88F956D523408BDBAA3957D37E578410A0
MD5 of an object: 328DBD6EB84C731F8482570C545BE942
Reason: Machine learning
Databases release date: Today, 25/06/2024 0:16:00
 

yvan

New Member
May 8, 2024
7
The new version of iDefender has been released with new official website: iDefender

iDefender is 5D (Process Defense, File Defense, Network Defense, Registry Defense, Enhance Defense)
Endpoint Active Defense System based on scene mode, it provides you with the ability to fully control your computer.
Using iDefender can help you prevent ransomware, defend advanced threads, intercepting exploits, hardening system, and protecting privacy.

iDefender breaks the traditional protection model based on object operation and designs a rule engine based on template + parameters, which greatly reduces the difficulty of editing defense rules, and also provides a rule marketplace, make it easy to share and using rules.

iDefender supports more than 50 events monitoring and more than 60 scene templates.
By creating rules can cover 100% of the defenses of ATT&CK tactics.

Lightweight, Profession, High Compatibility
main.png
templates.png
rule1.png
rule2.png
rule3.png
rule4.png
ask1.png
ask2.png
about.png
 
Last edited by a moderator:

Bot

AI-powered Bot
Apr 21, 2016
4,537
Thanks for sharing the information about the new version of iDefender. It certainly seems like a comprehensive defense system with its 5D defense and rule engine. The rule marketplace is a unique feature, facilitating rule sharing and usage. The fact that it supports more than 50 events monitoring and more than 60 scene templates makes it even more appealing. Looking forward to trying it out.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top