EQSecure 3.41 Settings

Hi hammerman

Some of these leaktests in my opinion border on bogus, Coat is one of them.

In one respect, the very action of this exectuable launching is immediately intercepted, but after allowing it to run.............

I just repeated this test and reproduced the exact same results as you. "IF" you click ALLOW then it activates the command console to proceed, (EQS Alerts!), the evidence from this leaktest indicates in print that we failed, however using IE, no launching of IE ever took place, at least i find no evidence in this test that my browser ever reached that website it claims to have.

I ran lt-coat.exe both from DropToDOS and simply clicking on it, FWIW, my firewall didn't pop up either.

 

Hi,

I really don´t have a clue how to make the custom rules work (made by Alcyon), can anyone help?

 

Alcyon and i'm sure others can steer you in the right direction, right now i'm having a field day going over ALL those super cool new entries and trying to sort them out myself.

One thing i'm perfectly confident of is that once i get all this is sorted out like you, EQS is going to be nearly air-tight because for the first time i can finally use the Ban List as it was intended to effectively LOCK OUT potential malicious drop-ins

 

As an EQS-newbie not familiar whit rules and parent/child processes I really would like to know about the Other options in the popup warning box. If you click the Other options during an alert you can choose between:

1. Remember this action for this parent process
2. Prompt again when application is modified (I did notice this one was greyed out last time I got an alert, but dont know why) See picture.


If someone could provide info on this subject I would appreciate it

To trigger the alert in the picture I went to Control Panel, Security Center, and clicked "Read help about Security Center". I did block but was still able to read help about Security Center. I may have misunderstood. I dont have a problem with this because I only triggered this alert to be able to shoot a screenie of the alert.

 

We are in the same boat as I am using EQSecure as a learning tool.
As far as Parent Process:
I can give you an example. If I start a program, say, Winamp, and then launch Process Explorer, and use it to kill Winamp, I'll receive a prompt from EQS.

If I choose Allow and Remember this action, then Process Explorer will always have permission to kill Winamp, but ONLY Winamp.

If I choose Allow and Remember this action for this parent process, then I tell EQS to allow Process Explorer to kill ANY process without future prompts, unless, of course, the act of killing a process would conflict with one of the Global or Blacklist rules.

The priority seems to be (correct me if I'm wrong) an action is checked against the rules you see on the mainpage of EQS:



In this case, Process Explorer terminating Winamp.
If no other rule exists in the custom rules, then I am given a prompt (Prompt and Allow).
If, however, I have created a rule, in this case in Application Protection Settings to allow Process Explorer to terminate Winamp, then I receive no prompt, and P.E. kills Winamp. This rule I have created (P.E. kill Winamp) is also checked against the Global and Blacklist settings, which seem to have the final say.
Meaning, even if I create a rule permanently allowing P.E. to kill Winamp in the Application Protection Settings, if it conflicts with a rule I've created in either Global or Blacklist, I'll receive a prompt. Delete the conflicting rule(s) from Global or Blacklist, and once again, P.E. can terminate Winamp without prompts from EQS.

Prompt again when application is modified means that if a process is modified at all, whether legitimately through an update or covertly through malware, you'll be prompted before it can take any action, if you've chosen that option.

I tried the same steps you took: Security Center (Rundll32.exe)>Get help about Security Center(HelpCtr.exe), and was also able to launch it. However by the prompts I received, and by the picture you've posted, EQS wasn't prompting on HelpCtr.exe executing, it was prompting on a registry change. I believe I was not prompted on the execution of HelpCtr.exe because I have the option Automatically trust processes digitally signed by MSoft enabled. Again correct me if I'm wrong.

I hope this helps you tepe2. I'm sure other, more experienced users can provide further info and correct any errors I've made.

 

It sure helps a lot Boonie. The way you explain it a newbie like me can understand. Thank you so much

 

My pleasure
There's a lot to experiment with here. For my part, it's good to have FD-ISR to fall back on should I make a serious error.

 

@ Hammerman, thanks for the report. I'll fix it in the next update.

@ Rasheed187, what exactly would you like to know?

@ Bonnie, thanks It's because the "Automatically trust processes digitally signed by Microsoft" option wasn't unchecked.

 

A new version of my ruleset is available at post #112. Updated to v03242008-2, thanks Hammerman.

 

Here's a new and probably last version of my ruleset. I did everything i could, spent enough time on it and i'm out of ideas. It's now up to you to improve it. I hope you'll enjoy. You need to replace .txt with .zip

Edit: some rules renamed & typos corrected

 

Did you think to include also a Changelog with it?

Only kidding.

Alcyon you've really gone beyond our wildest expectations and we thank you so very much for all the effort and time that you've obviously taken to perfect those rules as best as humanly possible.

It's raised the bar of confidence many levels for many of us and it's definitely provided a useful template from which to work from.

EASTER

 

EASTER, some interesting global rules in file protection settings have been added

 

Many thanks Alcyon for your nice and hard work. Your Ruleset is definitly a must for those of us who are using EQSecure

 

Great stuff! Thanks for all the hard work Alcyon.

 

Thanks for the new ruleset and I appreciate the hard work that must have gone into this.

I like the additional file protection rules. The invalid location rules are an interesting addition. I was wondering if there was a case for moving the list of known malware files (eg. variations of svchost, lsass etc) into the Blacklist rather than in Global Rules. Also, there are rules for IE, OE, MSN in both Global Rules and Blacklist. I assume this is simply to offer choice of using one or the other.

Thanks again.

 

hammerman,

Blacklist rules have higher priority over global rules so if you move the "invalid location rules" in the blacklist, those rules will cancel the ones for the same files in the global section so that's why it's preferable to leave them where they are.

 

Hi Alcyon,

I wasn't actually thinking of moving the "invalid location rules" but the malware groups such as System32 (Malware) and Windows Folder (Malware). These groups seem to be candidates for a blacklist since they contain known malware files only that are just blocked. Would welcome your expert advice.

 

Yes, you can move them to the blacklist without any problems. For "Windows Folder (Malware)", you can also add %WinDir%\service.exe, %WinDir%\spoolsv.exe, etc. Aswell, a good idea could be to make new rules ex: "block tricky names (Malwares)" and put %SystemDrive%\*\scvhost.exe - and any other tricky names -(create:block,read:ignore,modify:ignore,:delete:ignore) so it'll not only be limited to c:\windows and c:\windows\system32. As you can see with http://www.megasecurity.org/trojans/v/virulence/Virulence2.1.html, tricky names can be everywhere.

 

BTW, about the invalid location rules, to close even more doors you could add all windows xp default executables.

 

Very Good. And thanks again for a superb effort.

It's been said EQS is in a class of "dumb" HIPS;

Well i like to think of EQS as a pure "Template" HIPS, meaning once enough quality rules for the choicest locations are programmed into the configurations, then it becomes a much more "mindful" or "intelligent" HIPS of course, and not so dumb anymore. Hence a Template, a very useful pattern from which to add & work with maximum results.

In fact, in this form, i think it's the lightest approach that can be taken, making for the least minimal energy useage from CPU/Memory cycles while intercepting potential areas of vulnerability, startup locales, file extensions/registry keys & values, etc.

 

Hi everyone,

I have been trying to import those rule set (Alcyon's) but I just do not know how. Are we using the import option in the EQS interface? I also do not understand if the txt file is given the xml or zip extension. Any help will be greatly appreciated.

 

Change the .txt extension to .zip
Then use WinZip to unzip the file contents to a folder.
Go to the File Protection - Settings and import the File Rule sets from the folder. There will be one for Global Rules, one for Application Rules and one for Blacklists.
Go to Registry Protection - Settings and again import the three rule sets for registry protection.
Finally go to Application Protection - Settings and import the applications rules sets.

 

@hammerman,
Thank you so much. That was very easy.

Alcyon's ruleset are very comprehensive. EQS is now one of the best (if not the best) classical HIPS.

 

I still can't import Alcyons rule set.

http://img241.imageshack.us/img241/6028/eqjc3.jpg

because as shown in the screenie when I select import and navigate to where the rule set is it can't find the file when infact the file is there.

also does this rule set go into the Application ,registry or File protection??

 

You need to change the .txt file extension to .zip. Then unzip the file contents into a folder. You will then be able to import the rules.