Advice Request What built-in HIPS functionality exists in Windows 10 ?

[notabot]

What built-in HIPS functionality exists in Windows 10 ?

There are code integrity mechanisms and the event viewer could be configured as a detection tool but is I don’t see much in terms of HIPS

 

[Andy Ful]

HIPS rules are available only in Windows 10 E5 version (according to Microsoft):

 

[notabot]

HIPS rules are available only in Windows 10 E5 version (according to Microsoft):
View attachment 207549

Thanks @andy , Price of enterprise unfortunately quite steep.

What I see is that the HIPS rules are in enterprise, what is the HIPS module though ? Perhaps it’s available but someone would need to write their own rules.

Also is there a standalone hips program ( with nothing else, no AV, no anti exe - just hips ) which is also compatible with Defender ?

 

[shmu26]

Thanks @andy , Price of enterprise unfortunately quite steep.

What I see is that the HIPS rules are in enterprise, what is the HIPS module though ? Perhaps it’s available but someone would need to write their own rules.

Also is there a standalone hips program ( with nothing else, no AV, no anti exe - just hips ) which is also compatible with Defender ?

For standalone HIPS, your best bet is SpyShelter.
You could also use Comodo, and install just firewall without AV component. This will give you HIPS without anti-exe, if you leave it in the default "Firewall security" config.

As for using Windows Enterprise as HIPS, beside the expense, it is also hard to configure. (But if you want to try, just install Enterprise in a VM, everything will work except for customizations like desktop wallpaper. Alternatively, buy an Enterprise license on eBay for a few dollars, if your conscience permits.)

 

[Andy Ful]

Thanks @andy , Price of enterprise unfortunately quite steep.

What I see is that the HIPS rules are in enterprise, what is the HIPS module though ? Perhaps it’s available but someone would need to write their own rules.

Also is there a standalone hips program ( with nothing else, no AV, no anti exe - just hips ) which is also compatible with Defender ?

Excubits MemProtect.

 

[imuade]

Also is there a standalone hips program ( with nothing else, no AV, no anti exe - just hips ) which is also compatible with Defender ?

ReHIPS

 

[shmu26]

I would not call ReHIPS a true HIPS program. It is primarily a sandboxing program, which it calls "isolation", and it also does anti-exe and application control. But it doesn't monitor various actions like a true HIPS does.

 

[notabot]

Excubits MemProtect.

Thanks , unfortunately it installs a kernel driver which I’d rather avoid, ideally I’d want something that uses the mechanics provided by the OS. I guess to get HIPS functionality the only way it now is to deploy WDAC policies

 

[shmu26]

Thanks , unfortunately it installs a kernel driver which I’d rather avoid, ideally I’d want something that uses the mechanics provided by the OS. I guess to get HIPS functionality the only way it now is to deploy WDAC policies

If you get anywhere with those policies, please tell us about it. I don't see many people talking about how to use those tools.

 

[imuade]

Thanks , unfortunately it installs a kernel driver which I’d rather avoid, ideally I’d want something that uses the mechanics provided by the OS. I guess to get HIPS functionality the only way it now is to deploy WDAC policies

I'd have a look at Re:HIPS too.
Maybe it's more an anti-exe/sandboxing SW rather than a HIPS, but it's quite gentle with the OS:

ReHIPS ensures system integrity and stability
Unlike some other sandboxes ReHIPS doesn't use kernel-mode hooks, splicing and other unsafe rootkit-techniques. It is based on documented Windows security mechanisms ensuring system stability.

 

[Andy Ful]

Windows Defender Application Control (WDAC) is very different from HIPS.

"Windows Defender Application Control (WDAC) can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel). WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs in Constrained Language Mode."
Windows Defender Application Control (WDAC) (Windows 10)

So, WDAG is rather a kind of Software and Driver policy. It is very strong because it can block also .NET Dlls. I have been playing with it for some time, but it cannot be configured via GPO or PowerShell, or reg tweaks on Windows Home and Pro. WDAC can be deployed on any Windows 10 edition via SIPolicy.p7b file, or on Windows Pro (and higher ed.) via GPO if the user can have access to the custom policy .bin file. Both SIPolicy.p7b and the custom policy .bin file can be made from the .XML policy file when using PowerShell cmdlets on Windows Enterprise ed. On Windows Home and Pro the required cmdlets are not available, you get the error "ConvertFrom-CIPolicy : Device Guard is not available in this edition of Windows."

WDAC can be also optionally managed via Mobile Device Management (MDM), such as Microsoft Intune, but I did not try this.
I installed Windows 10 Enterprise, and then WDAC can be configured via PowerShell cmdlets.
I made the SIPolicy.p7b file that can be copied to C:\Windows\System32\CodeIntegrity, and then WDAC can work on Windows 10 Home and Pro.

In practice, WDAG restrictions can be applied on Windows Home and Pro via SIPolicy.p7b, as a default-allow setup with a blacklist for vulnerable applications (script interpreters, etc.) and DLLs - one can use the Bouncer blacklist for that.

The advanced users can apply WDAC restrictions as default deny setup for drivers and software, but it is not an easy solution, and can be dangerous to system stability on Windows Home.

 

[shmu26]

I'd have a look at Re:HIPS too.
Maybe it's more an anti-exe/sandboxing SW rather than a HIPS, but it's quite gentle with the OS:

+1

 

[shmu26]

Windows Defender Application Control (WDAC) is very different from HIPS.

"Windows Defender Application Control (WDAC) can help mitigate these types of security threats by restricting the applications that users are allowed to run and the code that runs in the System Core (kernel). WDAC policies also block unsigned scripts and MSIs, and Windows PowerShell runs in Constrained Language Mode."
Windows Defender Application Control (WDAC) (Windows 10)

So, WDAG is rather a kind of Software and Driver policy. It is very strong because it can block also .NET Dlls. I have been playing with it for some time, but it cannot be configured via GPO or PowerShell, or reg tweaks on Windows Home and Pro. WDAC can be deployed on any Windows 10 edition via SIPolicy.p7b file, or on Windows Pro (and higher ed.) via GPO if the user can have access to the custom policy .bin file. Both SIPolicy.p7b and the custom policy .bin file can be made from the .XML policy file when using PowerShell cmdlets on Windows Enterprise ed. On Windows Home and Pro the required cmdlets are not available, you get the error "ConvertFrom-CIPolicy : Device Guard is not available in this edition of Windows."

WDAC can be also optionally managed via Mobile Device Management (MDM), such as Microsoft Intune, but I did not try this.
I installed Windows 10 Enterprise, and then WDAC can be configured via PowerShell cmdlets.
I made the SIPolicy.p7b file that can be copied to C:\Windows\System32\CodeIntegrity, and then WDAC can work on Windows 10 Home and Pro.

In practice, WDAG restrictions can be applied on Windows Home and Pro via SIPolicy.p7b, as a default-allow setup with a blacklist for vulnerable applications (script interpreters, etc.) and DLLs - one can use the Bouncer blacklist for that.

The advanced users can apply WDAC restrictions as default deny setup for drivers and software, but it is not an easy solution, and can be dangerous to system stability on Windows Home.

Very Interesting!!
So once you generated a SIP file on Enterprise, you can use it and manage it on Win10 Home and Pro?
What specifically would a home user want to do with WDAC that he can't already do with H_C?

 

[Andy Ful]

Very Interesting!!
So once you generated a SIP file on Enterprise, you can use it and manage it on Win10 Home and Pro?
What specifically would a home user want to do with WDAC that he can't already do with H_C?

I redirected my answer about Windows Defender Application Control to the dedicated thread:
Discuss - Application Control on Windows 10 Home.

 

[notabot]

If you get anywhere with those policies, please tell us about it. I don't see many people talking about how to use those tools.

will do, I need a free evening to begin with and work & family don’t leave too many of these but when I do I’ll post findings.