HIPS rule settings

Rule nameUser-defined or automatically chosen rule name.

ActionSpecifies an action – Allow, Block or Ask – that should be performed if conditions are met.

Operations affecting – You must select the type of operation for which the rule will be applied. The rule will be used only for this type of operation and for the selected target.

Enabled – Disable this switch if you want to keep the rule in the list but not apply it.

LogIf you activate this option, information about this rule will be written to the HIPS log.

Notify userA small pop-up window appears in the lower-right corner if an event is triggered.

The rule consists of parts that describe the conditions triggering this rule:

Source applications The rule will be used only if the event is triggered by this application(s). Select Specific applications from drop-down menu and click Add to add new files or you can select All applications from the drop-down menu to add all applications.

Files The rule will be used only if the operation is related to this target. Select Specific files from drop-down menu and click Add to add new files or folders or you can select All files from the drop-down menu to add all applications.

Applications The rule will be used only if the operation is related to this target. Select Specific applications from the drop-down menu and click Add to add new files or folders or you can select All applications from the drop-down menu to add all applications.

Registry entries The rule will be used only if the operation is related to this target. Select Specific entries from the drop-down menu and click Add to add new files or folders, or you can select All entries from the drop-down menu to add all applications.

icon_details_hoverNOTE

Some operations of specific rules predefined by HIPS cannot be blocked and are allowed by default. In addition, not all system operations are monitored by HIPS. HIPS monitors operations that may be considered unsafe.

Descriptions of important operations:

File operations

Delete file – Application is asking for permission to delete the target file.
Write to file – Application is asking for permission to write to the target file.
Direct access to disk – Application is trying to read from or write to the disk in a non-standard way that will circumvent common Windows procedures. This may result in files being modified without the application of corresponding rules. This operation may be caused by malware trying to evade detection, backup software trying to make an exact copy of a disk, or a partition manager trying to reorganize disk volumes.
Install global hook – Refers to calling the SetWindowsHookEx function from the MSDN library.
Load driverInstallation and loading of drivers onto the system.

Application operations

Debug another application – Attaching a debugger to the process. While debugging an application, many details of its behavior can be viewed and modified and its data can be accessed.
Intercept events from another application – The source application is attempting to catch events targeted at a specific application (for example a keylogger trying to capture browser events).
Terminate/suspend another application – Suspending, resuming or terminating a process (can be accessed directly from Process Explorer or the Processes pane).
Start new application – Starting of new applications or processes.
Modify state of another application – The source application is attempting to write into the target applications' memory or run code on its behalf. This functionality may be useful to protect an essential application by configuring it as a target application in a rule blocking the use of this operation.

icon_details_hoverNOTE

It is not possible to intercept process operations on the 64-bit version of Windows XP.

Registry operations

Modify startup settings – Any changes in settings that define which applications will be run at Windows startup. These can be found, for example, by searching for the Run key in the Windows Registry.
Delete from registry – Deleting a registry key or its value.
Rename registry key – Renaming registry keys.
Modify registry – Creating new values of registry keys, changing existing values, moving data in the database tree or setting user or group rights for registry keys.

icon_details_hoverNOTE

Using wildcards in rules

An asterisk in rules can only be used to substitute a particular key, e.g. “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\*\Start”. Other ways of using wildcards are not supported.

Creating rules targeting HKEY_CURRENT_USER key

This key is just a link to the appropriate subkey of HKEY_USERS specific to the user identified by SID (secure identifier). In order to create a rule only for the current user, instead of using a path to HKEY_CURRENT_USER, use a path pointing to HKEY_USERS\%SID%. As SID you can use an asterisk to make the rule applicable for all users.

MONITOR_RED WARNING

If you create a very generic rule, the warning about this type of rule will be shown.

In the following example, we will demonstrate how to restrict unwanted behaviors of applications:

CONFIG_HIPS_RULES_EXAMPLE

1.Name the rule and select Block from the Action drop-down menu.
2.In the Operations affecting section, select at least one operation for  the rule.
3.Select the slider bar next to Log to enable logging for the new rule. Logs can be collected by Remote Administrator.
4.Select the slider bar next to Notify user to display a notification any time that a rule is applied. Click Next.

 

CONFIG_HIPS_RULES_EXAMPLE_2

5.In the Source applications window, select All applications from the drop-down menu to apply your new rule to all applications attempting to perform any of the selected operations. Click Next.
6.In the following window, select the slider bar next to Modify state of another application and click Next.
7.Select Specific applications from the drop-down menu and click Add to add one or more applications you want to block.
8.Click Finish to save your new rule.