Jump to content

Trooper

ESET Insiders
 View Profile  See their activity

  • Posts

    184

  • Joined

  • Last visited

 Content Type 

Posts posted by Trooper

    CVE-2022-30190

    in Malware Finding and Cleaning

    Posted

    On 6/1/2022 at 7:19 PM, itman said:

    I will note that for anyone using Eset recommended anti-ransomware HIPS rules, this attack can be mitigated by adding C:\Windows\System32\msdt.exe -EDIT- and C:\Windows\SysWOW64\msdt.exe to the list of specific startup applications for the rule named "Deny child processes from Office 20xx processes."

    Ref.: https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug

     

    Thanks for this @itmanis there anything else that I can do with ESET to block this?  I have done the MS registry key already at work.

    Cheers.

    ESET INSPECT Connector Agent Installation

    in ESET PROTECT

    Posted

    Hello, 

    Prior to the new update this week, I was able to install the ESET INSPECT Connector Agent from the console by selecting an endpoint. 

    Then on the bottom of the portal click on Computer>Solutions>Deploy Inspect Agent.

    It is now gone from the menu.  Is this a bug or not?  Why would you remove such a useful feature from the portal?

    Endpoint doesn't auto-update to 9.0.2046

    in ESET Endpoint Products

    Posted

    On 4/26/2022 at 12:23 PM, Ufoto said:

    Hi Marcos,

    I understand that this is the first time you are pushing updates this way, however I wanted to ask whether there will be a more official channel where we can track when a new version will be rolled out. Additionally, having the option to change that time frame would be ideal as in my opinion using an outdated version for nearly two months is too much. A month should be more than sufficient for any critical issues to surface. 

    Agreed.  The wait time is a bit too much.

    The system is busy due to many simultaneous user actions and may be less responsive

    in ESET PROTECT

    Posted

    On 4/5/2022 at 7:35 AM, Peter Randziak said:

    Hello @Trooper

    On how many systems do you make the changes at the same time?

    Does it sort out by itself in few moments?

    How exactly do you change the details? From the computer details screen?

    Can you please send me privately our public license ID or ECP Instance ID to check it?

    Peter

    Hi Peter,

    I was only make one change at a time and it was quite slow.  Took awhile for it to sort itself.   I will send you your request via PM.

    Thanks.

    Endpoint doesn't auto-update to 9.0.2046

    in ESET Endpoint Products

    Posted

    I would appreciate the delay but I normally do some research prior to pushing out to endpoints.  I understand the delay, but in my opinion, 30-60 days is a bit to much. Other admins may agree or disagree I suppose based upon their individual environments.  I only said that because I would normally not wait a month or two prior to updating.  Especially when there are bugs or security issues with the software being patched.  I guess a happy medium would be nice.

    Endpoint doesn't auto-update to 9.0.2046

    in ESET Endpoint Products

    Posted

    Greater control for admins would be nice.  I agree with the OP, there is no statement anywhere about this delay. I opened up a ticket with support on Friday and got no where fast.  I finally ended up chatting with tech support who told me it would work somewhere between 48-72 hours after release.  Might want to get your support staff on board with the delay of the auto upgrade working.

    Again, it would be nice to grant admins the ability to test this out sooner rather than having to wait 30-60 days.  I understand you are looking for stability etc but with this delay, the auto upgrade feature is useless to me as I normally would not wait this long to upgrade my endpoints.

    ESET Endpoint Security Log Files

    in ESET Endpoint Products

    Posted

    15 minutes ago, Marcos said:

    Do not enable advanced logging under Tools -> Diagnostics in the advanced setup. Moreover, enabling it triggers the following notification that pops up in regular intervals until you disable logging to remind you:

    image.png

    Thank you, Marcos.  It was indeed enabled for a few different things.  I have disabled it altogther.

    Cheers!

    ESET Endpoint Security Log Files

    in ESET Endpoint Products

    Posted

    I started noticing recently that my machine seemed to be using up more disk space than usual. After taking a look around, I found the culprit.

    It is located at C:\ProgramData\ESET\ESET Security\Diagnostics\ The file in question is named EpfwLog.pcapng

    On some endpoints, this file was larger than 300GB!

    What can I do from a policy standpoint to avoid this happening in the future?  For now, I was able to delete the files in question using PDQ deploy, so a crisis was averted.

    Appreciate any input on this.

    Thanks!

    Botnet.CnC.Generic on one Endpoint

    in Malware Finding and Cleaning

    Posted

    3 hours ago, itman said:

    IP address, 162.210.199.65, is suspicious. Two sources at VT, Comodo and Webroot, flag it as malicious. Also, another source that tracks coin mining sites flagged it.

    Upon access to hxxps://162.210.199.65/, Eset immediately throws the botnet alert. As such, Eset has blacklisted the IP address.

    Thanks very much for looking into this.  I am super glad that ESET blocked it.

    Dashboard is not reporting Windows updates available for WIN2016, WIN2019, and WIN2022 servers.

    in ESET PROTECT On-prem (Remote Management)

    Posted

    4 hours ago, Kathleen Y said:

    Hello,

    I passed along the screen shot to my IT manager.  He asked the following :

    Our policies are getting old

    Our are current custom policies out of date?  Do we need to Update polices with each new version?

    What is the best practice for policy management?

    Our current policies for servers are set to notify on critical updates, Can we select more that one option in the drop down menu?

     

     

    Eset Policy location.png

    It is difficult to tell from your screenshot here.  Might be best to touch base with ESET support regarding this.  Everyone's environment is different.

×
×
  • Create New...