Xcitium Enterprise

Enable HIPS

Activate or deactivate HIPS protection on managed computers to which the profile is applied.

If enabled, you can configure the HIPS security level and monitoring settings.

(Default=Enabled in safe mode)

Hips Security Level

If HIPS is enabled, you can choose the security level for the HIPS to provide at the managed computer from the drop-down below 'Enable HIPS'.

The available options are:

• Paranoid Mode: This is the highest security level setting and means that HIPS monitors and controls all executable files apart from those that you have deemed safe. Xcitium Client Security does not attempt to learn the behavior of any applications - even those applications on the Xcitium safe list and only uses your configuration settings to filter critical system activity. Similarly, the Xcitium Client Security does automatically create 'Allow' rules for any executables - although the end user still has the option to treat an application as 'Trusted' at the HIPS alert. Choosing this option generates the most amount of HIPS alerts and is recommended for advanced users that require complete awareness of activity on their system.

• Safe Mode: While monitoring critical system activity, HIPS automatically learns the activity of executables and applications certified as 'Safe' by Xcitium. It also automatically creates 'Allow' rules for these activities, if the option 'Create rules for safe applications' is selected. For non-certified, unknown, applications, the end-user will receive an alert whenever that application attempts to run. Should you choose, the end-user can add that new application to the safe list by choosing 'Treat this application as a Trusted Application' at the alert. This instructs the HIPS not to generate an alert the next time it runs. If the endpoint is not new or known to be free of malware and other threats then 'Safe Mode' is recommended setting for most users - combining the highest levels of security with an easy-to-manage number of HIPS alerts.

• Training Mode: HIPS monitors and learn the activity of any and all executables and create automatic 'Allow' rules until the security level is adjusted. The end-user will not receive any HIPS alerts in 'Training Mode'. If you choose the 'Training Mode' setting, we advise that you are 100% sure that all applications and executables installed on the endpoints are safe to run.

• Note - If required you can enable training mode to work temporarily. To do that, select 'Temporarily switch HIPS to training mode' option and set the days / hours.

After the countdown is over, XCS will switch back to previous mode and Windows Communication Client continues to synchronize training mode configuration settings that can't change locally.

Monitoring Settings

If HIPS is enabled, you can configure the activities, entities and objects that should monitored by it at the managed endpoint by clicking the 'Monitoring Settings' link.

Activities To Monitor:

• Interprocess Memory Access - Malware programs use memory space modification to inject malicious code for numerous types of attacks. These include recording your keyboard strokes; modifying the behavior of applications and stealing data by sending confidential information from one process to another. One of the most serious aspects of memory-space breaches is the ability of the offending malware to take the identity of a compromised process to 'impersonate' the application under attack. This makes life harder for traditional virus scanning software and intrusion-detection systems. Leave this option selected, and HIPS generates alerts when an application attempts to modify the memory space allocated to another application (Default = Enabled)

• Windows/WinEvent Hooks - In the Microsoft Windows® operating system, a hook is a mechanism by which a function can intercept events before they reach an application. Example intercepted events include messages, mouse actions and keystrokes. Hooks can react to these events and, in some cases, modify or discard them. Originally developed to allow legitimate software developers to develop more powerful and useful applications, hooks have also been exploited by hackers to create more powerful malware. Examples include malware that can record every stroke on your keyboard; record your mouse movements; monitor and modify all messages on your computer and take remote control of your computer. Leaving this option selected means that an alert is generated every time a hook is executed by an untrusted application (Default = Enabled).

• Device Driver Installations - Device drivers are small programs that allow applications and/or operating systems to interact with hardware devices on the managed computer. Hardware devices include your disk drives, graphics card, wireless and LAN network cards, CPU, mouse, USB devices, monitor, DVD player etc. Even the installation of a perfectly well-intentioned device driver can lead to system instability if it conflicts with other drivers on the system. The installation of a malicious driver could, obviously, cause irreparable damage to the computer or even pass control of that device to a hacker. Leaving this option selected means HIPS generates alerts every time a device driver is installed on the computer by an untrusted application (Default = Enabled).

• Processes' Terminations - A process is a running instance of a program. Terminating a process, obviously, terminates the program. Viruses and Trojan horses often try to shut down the processes of any security software you have been running in order to bypass it. With this setting enabled, HIPS monitors and generates alerts for all attempts by an untrusted application to close down another application (Default = Enabled).

• Process Execution - Malware such as rootkits and key-loggers often execute as background processes. With this setting enabled, HIPS monitors and generates alerts whenever a process is invoked by an untrusted application. (Default = Enabled).

• Windows Messages - This setting means Xcitium Client Security monitors and detects if one application attempts to send special Windows Messages to modify the behavior of another application (e.g. by using the WM_PASTE command) (Default = Enabled).

• DNS/RPC Client Service - This setting generates alerts if an application attempts to access the 'Windows DNS service' - possibly in order to launch a DNS recursion attack. A DNS recursion attack is a type of Distributed Denial of Service attack whereby a malicious entity sends several thousand spoofed requests to a DNS server. The requests are spoofed in that they appear to come from the target or 'victim' server but in fact come from different sources - often a network of 'zombie' computers which send out the requests without the owners knowledge. The DNS servers are tricked into sending all their replies to the victim server - overwhelming it with requests and causing it to crash. Leaving this setting enabled prevents malware from using the DNS Client Service to launch such an attack (Default = Enabled).

Objects To Monitor Against Modifications:

• Protected COM Interfaces enables monitoring of COM interfaces you specified from the COM Protection pane. (Default = Enabled).

• Protected Registry Keys enables monitoring of Registry keys you specified from the Registry Protection pane. (Default = Enabled).

• Protected Files/Folders enables monitoring of files and folders you specified from the File Protection pane. (Default = Enabled).

Objects To Monitor Against Direct Access:

Determines whether or not Xcitium Client Security should monitor access to system critical objects on the managed computer. Using direct access methods, malicious applications can obtain data from a storage devices, modify or infect other executable software, record keystrokes and more. Xcitium advises the average user to leave these settings enabled:

• Physical Memory: Monitors your computer's memory for direct access by an applications and processes. Malicious programs attempt to access physical memory to run a wide range of exploits - the most famous being the 'Buffer Overflow' exploit. Buffer overruns occur when an interface designed to store a certain amount of data at a specific address in memory allows a malicious process to supply too much data to that address. This overwrites its internal structures and can be used by malware to force the system to execute its code (Default = Enabled).

• Computer Monitor: Xcitium Client Security raises an alert every time a process tries to directly access the computer monitor. Although legitimate applications sometimes require this access, spyware can also use such access to take screen shots of the current desktop, record browsing activities of the user and more (Default = Enabled).

• Disks: Monitors the local disk drives at the managed computer, for direct access by running processes. This helps guard against malicious software that need this access to, for example, obtain data stored on the drives, destroy files on a hard disk, format the drive or corrupt the file system by writing junk data (Default = Enabled).

• Keyboard: Monitors the keyboard for access attempts. Malicious software, known as 'key loggers', can record every stroke made on keyboard and can be used to steal passwords, credit card numbers and other personal data typed through the keyboard. With this setting is enabled, Xcitium Client Security generates alerts every time an application attempts to establish direct access to the keyboard (Default = Enabled).

Note: The settings you choose here are universally applied. If you disable monitoring of an activity, entity or object using this interface it completely switches off monitoring of that activity on a global basis - effectively creating a universal 'Allow' rule for that activity . This 'Allow' setting over-rules any Ruleset specific 'Block' or 'Ask' setting for that activity that you may have selected using the 'Access Rights' and 'Protection Settings' interface.

Do NOT show popup alerts

Configure whether or not the HIPS alerts are to be displayed at the managed computer for the end-user to respond. Choosing 'Do NOT show popup alerts' will minimize disturbances but at some loss of user awareness (Default = Enabled).

If you choose not to show alerts then you have a choice of default responses that XCS should automatically take - either 'Block Requests' or 'Allow Requests'.

Set popup alerts to verbose mode

Enabling this option instructs XCS to display HIPS alerts in verbose mode, providing more more informative alerts and more options for the user to allow or block the requests (Default = Enabled).

Create rules for safe applications

XCS will auto-create allow rules for known-safe applications. (Default = Disabled).It  is disabled by default for all predefined Endpoint Manager profiles.

Note: HIPS trusts an application if:

• The app is from a vendor who has a 'Trusted' status in the local vendor list in XCS

• The app is trusted in the online file database (aka, it is whitelisted)

• The app is trusted in the local XCS 'File List'
  

See File Rating Settings for more details.

Set new on-screen alert timeout to

Determines how long the HIPS shows an alert for without any user intervention. By default, the timeout is set at 60 seconds. You may adjust this setting to your own preference.

Enable adaptive mode under low system resources

Very rarely (and only in a heavily loaded system), low memory conditions might cause certain XCS functions to fail. With this option enabled, XCS will attempt to locate and utilize memory using adaptive techniques so that it can complete its pending tasks. However, the cost of enabling this option may be reduced performance in even lightly loaded systems (Default = Enabled).

Block unknown requests when the application is not running

Selecting this option blocks all unknown execution requests if Xcitium Client Security is not running/has been shut down. This is option is very strict indeed and in most cases should only be enabled on seriously infested or compromised machines while the user is working to resolve these issues. If you know the managed computer machine is already 'clean' and are looking just to enable the highest XCS security settings then it is OK to leave this option disabled. (Default = Disabled)

Enable enhanced protection mode (Requires a system restart)

64 bit systems only. Activate additional protections which counteract sophisticated malware that tries to bypass regular HIPS protection. Because of limitations in Windows 7/8 x64 systems, some HIPS functions in previous versions of XCS could theoretically be bypassed by malware. Enhanced Protection Mode implements several patent-pending ways to improve HIPS. The endpoint requires a restart to enable enhanced protection mode. (Default = Disabled)

Note: HIPS Rulesets are to be created before applying them to an individual application or an application group. Refer to the next section Rulesets for details on creating new rulesets.

Application

Name of the individual application or the application group to which the ruleset is applied

Treat As

The ruleset applied. For more details on the rulesets, see the next section Rulesets.

Actions

Contains control buttons to edit or remove the rule

Note: Xcitium ships with a set of predefined file groups containing collections of files under respective categories. Admins can also create custom file groups with required applications. All the pre-defined and the custom file groups will be available in the drop-down. The custom file groups can be created under 'Settings' > 'Settings' > 'System Templates' > 'File Groups Variables' interface. See Create and Manage File Groups for more details.

Note: Predefined Rulesets, once chosen, cannot be modified directly from this interface - they can only be modified and defined using the Ruleset interface. If you require the ability to modify components of the rule set, then you are effectively creating a new, custom ruleset and should choose the more flexible Use Custom Ruleset option instead.

• To view the list of individual files, programs, applications added to the Protected Files list and manage them, choose 'File List'

• To view the File Groups added to the Protected File list, choose 'Group List'

Note: Xcitium ships with a set of predefined file groups containing collections of files under respective categories. You can also create custom file groups with required applications. All the pre-defined and the custom file groups will be available in the drop-down. The custom file groups can be created under 'Settings' > 'Settings' > 'System Templates' > 'File Groups Variables' interface. See Create and Manage File Groups for more details.

• To view the list of individual keys and values, and manage them, choose 'Key List'

• To view the Registry Groups, choose 'Group List'

Note: Xcitium ships with a set of predefined Registry groups containing collections of registry keys under respective categories. You can also create custom Registry groups with required key values. All the pre-defined and the custom Registry groups will be available in the drop-down. The custom Registry groups can be created under 'Settings' > 'Settings' > 'System Templates' > 'Registry Variables' interface. See Create and Manage Registry Groups for more details.

• To view the list of individual COM Interfaces/Classes and manage them, choose 'Classes List'

• To view the COM Groups and manage them, choose 'Group List'

Note: Xcitium ships with a set of predefined COM groups containing collections of COM interfaces under respective categories. You can also create custom COM groups with required COM objects. All the pre-defined and the custom file groups will be available in the drop-down. The custom COM groups can be created under 'Settings' > 'Settings' > 'System Templates' > 'COM Variables' interface. See Create and Manage COM Groups for more details.