ESET Online Help

Search English
Select the topic

Advanced options

In Advanced setup > Protections > Network access protection > Network attack protection > Advanced options, you can enable or disable detection of several types of attacks and exploits that may harm your computer.

note

In some cases, you will not receive a threat notification about blocked communications. See the Logging and creating rules or exceptions from log section for instructions to view all blocked communications in the firewall log.

important

The availability of specific options in this window may vary depending on the type or version of your ESET product and firewall module, as well as the version of your operating system.

icon_section Intrusion detection

  • Protocol SMB—Detects and blocks various security problems in SMB protocol, namely:
  • Rogue server challenge attack authentication detection—Protects against an attack that uses a rogue challenge during authentication to obtain user credentials.
  • IDS evasion during named pipe opening detection—Detection of known evasion techniques used for opening MSRPCS named pipes in SMB protocol.
  • CVE detections (Common Vulnerabilities and Exposures)—Implemented detection methods of various attacks, forms, security holes and exploits over SMB protocol. See the CVE website at cve.mitre.org to search and obtain more detailed info about CVE identifiers (CVEs).
  • Protocol RPC—Detects and blocks various CVEs in the remote procedure call system developed for the Distributed Computing Environment (DCE).
  • Protocol RDP—Detects and blocks various CVEs in the RDP protocol (see above).
  • Block unsafe address after attack detection—IP addresses detected as sources of attacks are added to the Blacklist to prevent connection for a certain time. You can define Blacklist retention period, which sets the time for how long the address will be blocked after attack detection.
  • Notify about attack detection—Turns on the Windows notification area notification at the bottom right corner of the screen.
  • Notify about incoming attacks against security holes—Alerts you if attacks against security holes are detected or if an attempt is made by a threat to enter the system this way.

icon_section Packet inspection

  • Allow incoming connection to admin shares in SMB protocol—The administrative shares (admin shares) are the default network shares that share hard drive partitions (C$, D$, ...) in the system together with the system folder (ADMIN$). Disabling connection to admin shares should mitigate many security risks. For example, the Conficker worm performs dictionary attacks to connect to admin shares.
  • Deny old (unsupported) SMB dialects—Deny SMB sessions that use an old SMB dialect unsupported by IDS. Modern Windows operating systems support old SMB dialects due to backward compatibility with old operating systems such as Windows 95. The attacker can use an old dialect in an SMB session to evade traffic inspection. Deny old SMB dialects if your computer does not need to share files (or use SMB communication in general) with a computer with an old version of Windows.
  • Deny SMB sessions without extended security—Extended security can be used during the SMB session negotiation to provide a more secure authentication mechanism than LAN Manager Challenge/Response (LM) authentication. The LM scheme is considered weak and is not recommended for use.
  • Allow communication with the Security Account Manager service—For more information about this service see [MS-SAMR].
  • Allow communication with the Local Security Authority service—For more information about this service see [MS-LSAD] and [MS-LSAT].
  • Allow communication with the Remote Registry service—For more information about this service see [MS-RRP].
  • Allow communication with the Service Control Manager service—For more information about this service see [MS-SCMR].
  • Allow communication with the Server service—For information about this service see [MS-SRVS].
  • Allow communication with the other services—Other MSRPC services. MSRPC is the Microsoft implementation of the DCE RPC mechanism. Moreover, MSRPC can use named pipes carried into the SMB (network file sharing) protocol for transport (ncacn_np transport). MSRPC services provide interfaces for accessing and managing windows systems remotely. Several security vulnerabilities have been discovered and exploited in the wild in the Windows MSRPC system (for example, Conficker worm, Sasser worm,…). Disable communication with MSRPC services that you do not need to provide to mitigate many security risks (such as remote code execution or service failure attacks).