Is there a standalone highly effective HIPS product?

[Wave]

It is not a bug, it is the way HIPS functions. For example,

execute Parent_Malicious_Process.exe > attempts to execute Child_Malicious_Process.exe > user Allows > Child_Malicious_Process.exe attempts to execute Windows process > user Terminates Child_Malicious_Process.exe > dependent upon settings either the Child_Malicous_Process.exe only or both it and its child will be terminated

The Parent_Malicious_Process.exe can still be loaded in active memory since the user only terminated the child process (Child_Malicious_Process.exe). If the user had terminated the parent, then it would not be loaded into active memory - and the entire run sequence would have been terminated right there and then.

However, there are some malicious processes that resist termination using HIPS, antivirus, behavior blockers, and various other utilities. As long as an autorun has not been created by the process, a system reboot will clear active memory and it will not reload.

Yes, I thought that it was meant that when the user terminated the parent process it stayed in memory instead - basically I misunderstood what was said.

I'm not a user of SpS so when I misunderstood I assumed there was a bug, now I understand what's going on here, thank you

As for the resist termination, on x64 you can terminate any process from kernel mode, since malware cannot hook the kernel and therefore you can just bypass access checks incase of a kernelmode callback being used via ObOpenObjectByPointer and then on x86 you can just repair SSDT if it's hooked etc

 

[shmu26]

Yes, I thought that it was meant that when the user terminated the parent process it stayed in memory instead - basically I misunderstood what was said.

I'm not a user of SpS so when I misunderstood I assumed there was a bug, now I understand what's going on here, thank you

As for the resist termination, on x64 you can terminate any process from kernel mode, since malware cannot hook the kernel and therefore you can just bypass access checks incase of a kernelmode callback being used via ObOpenObjectByPointer and then on x86 you can just repair SSDT if it's hooked etc

SpS has known limitations on x64 systems, that's the problem here.

 

[Wave]

SpS has known limitations on x64 systems, that's the problem here.

If it's attempting to terminate the target process from user-mode then it can be prevented easily, whereas if they are using kernelmode for the termination then they can do more than the standard call to NtOpenProcess to obtain the handle.

In fact, even if they do it from user-mode they could try a direct system call to make it more effective.

However, on x86 systems where you can freely patch the kernel, rootkits can do a lot to prevent termination... Then it becomes a game of reverting the effects, cleaning out system drivers responsible for the patch modifications at reboot (e.g. removing a system file which set active kernelmode hooks prior to unhooking would cause a BSoD), etc.

Therefore, even though SpyShelter may have some limitations on x64 (due to not being able to patch the kernel), it is actually easier for them to make better termination for the x64 version, since malware will also have these restrictions (therefore ObOpenObjectByPointer cannot be hooked to be blocked but it is capable of bypassing kernelmode callbacks used for process protection).

 

[shmu26]

If it's attempting to terminate the target process from user-mode then it can be prevented easily, whereas if they are using kernelmode for the termination then they can do more than the standard call to NtOpenProcess to obtain the handle.

In fact, even if they do it from user-mode they could try a direct system call to make it more effective.

However, on x86 systems where you can freely patch the kernel, rootkits can do a lot to prevent termination... Then it becomes a game of reverting the effects, cleaning out system drivers responsible for the patch modifications at reboot (e.g. removing a system file which set active kernelmode hooks prior to unhooking would cause a BSoD), etc.

Therefore, even though SpyShelter may have some limitations on x64 (due to not being able to patch the kernel), it is actually easier for them to make better termination for the x64 version, since malware will also have these restrictions (therefore ObOpenObjectByPointer cannot be hooked to be blocked but it is capable of bypassing kernelmode callbacks used for process protection).

Wave, I will just have to believe you, because this is getting over my head...

 

[bunchuu]

I herd that win patrol is "stand alone" light HIPS but I didn't try it yet. They also create specific anti ransomware.