Patriot NG new hips

Patriot is a 'Host IDS' tool which allows real time monitoring of changes in Windows systems or Network attacks.

Patriot monitors:

Changes in Registry keys: Indicating whether any sensitive key (autorun, internet explorer settings...) is altered.
New files in 'Startup' directories
New Users in the System
New Services installed
Changes in the hosts file
New scheduled jobs
Alteration of the integrity of Internet Explorer: (New BHOs, configuration changes, new toolbars)
Changes in ARP table (Prevention of MITM attacks)
Installation of new Drivers
New Netbios shares
TCP/IP Defense (New open ports, new connections made by processes, PortScan detection...)
Files in critical directories (New executables, new DLLs...)
New hidden windows (cmd.exe / Internet Explorer using OLE objects)
Netbios connections to the System
ARP Watch (New hosts in your network)
NIDS (Detect anomalous network traffic based on editable rules)


website : http://www.security-projects.com/?Patriot_NG

 

very interesting winpatrol's like

 

Not really. WinPatrol is light. This "thing" takes up 30-40MB. Seems like it has a very bad capabilities/resources ratio.

 

Yeah it does sound a bit like WinPatrol, in some ways, but has other nice features. Worth testing i think.

Installed Winpcap but didn't reboot, as i'm in SD mode. Whether not rebooting effects anything ?

It took several minutes to Totally launch ! I thought it had crashed etc at first

RAM usage about 25 Megs on XP/SP2.

Demo videos available but in Spanish

@ Nizarawi

Thanks for posting

 

Is this freeware? Should it be under lightweight HIPS?

 

this app is too hardcore for me

 

To test it i installed several Apps that between them installed LOTS of Registry entries & also a few Services & Drivers.

Not a peep out of it ?

Also on R-clicking the taskbar icon to show Status, instead it showed Stopped ?

As i mentioned earlier, i didn't reboot after installing the required WinPcap, but i would have thought that would only affect the network etc stuff ?

Be nice to see others do something similar & show what alerts etc they get, or not.

 

Indeed:

Whois Record For Security-Projects.com

Registrant:
Whoiscontactsprotection.com
Girona 81-83 local 6
Malgrat de Mar, 08380
+34.937611042

http://whoiscontactsprotection.com/

 

OK...it looks "not bad" and I have installed it. After installation WinPcap restart was no needed, after installation Patriot - the same. Inteface is a bit like All Seeing Eye (IMO) - you can fix features (protected areas) in one window, but there is no system scan...looks like behavioral blocker?...no "black/white lists, no predefined rules(?)...
4 processes still work in system and their memory usage is about 45-50 MB RAM

And now something strange...agter updating "NIDS rules" process "stoper-NIDS.exe" becomes as child process

Patriot correctly detects itself

new connection opened by browsers, new opened port

and changing the IE homepage

Ptriot is not "anti-executable"...I am running various programs (FreeCommander, XMPlay, Media Player HC, CCleaner, Regseeker) and there was no reaction. But the most interesting is now...
try to run registry entries finder like Regseeker,
in searching box type the word "patriot"
and than remove all entries that you see
And what?...nothing...we have no reaction from Patriot and all features are becoming disabled. We have no protection(?!) Patriot has no "self-protection"(?!). It's a bug?...what do you think about this?

 

That's what happened to me when I didn't run it as an administrator.

 

Ok, thanks

I've since found that if you keep relaunching PNG it spawns copies of it's .EXE's & therefore the memory usage goes up !

Shame about the "self-protection" Might be a bug, or it's not built into it yet, early days

Except i am in Admin ?