Jump to content

Mitchell

Members
 View Profile  See their activity

  • Posts

    30

  • Joined

  • Days Won

    2

 Content Type 

Posts posted by Mitchell

    ESET Inspect Cloud via ESET Bridge

    in ESET Inspect

    Posted

    This is possible, you just have to add the address and port to the allowed list in config.
    image.thumb.png.306cec191c33f1d48ac000999f587f2d.png

    Pick the address based on the location of your ESET Inspect Cloud Instance

    eu01.agent.edr.eset.systems or IP 52.166.186.239

    TCP/8093

    ESET Inspect Cloud Connector Location: Europe

    us01.agent.edr.eset.systems or IP

    40.83.252.19

    TCP/8093

    ESET Inspect Cloud Connector Location: USA

    jp01.agent.edr.eset.systems or IP

    20.188.24.252

    TCP/8093

    ESET Inspect Cloud Connector Location: Japan

    Hash Blocked by ESET Inspect

    in ESET Inspect On-prem (Detection and Response)

    Posted

    The following buit-in rules have an action that can result in a blocked hash. (i'm not sure which of these are enabled by-default however):

      

    <name>Process has started from Recycle Bin folder [A0412]</name>
<name>Suspicious executable created in %startup% folder [A0127b]</name>
<name>Regsvr32 has dropped a suspicious executable [A0311]</name>
<name>Certutil has dropped a suspicious executable [A0313]</name>
<name>Process executed from ADS [A0417]</name>
<name>Process with mimikatz-like executable metadata executed [A0423]</name>
<name>Ransomware-like data written to file [A0603]</name>
<name>Multiple file writes from a compromised process [A0606]</name>
<name>Multiple file renames from a compromised process [A0607]</name>
<name>Remote execution using renamed PsExec service [A0905]</name>
<name>Canary File was Triggered [D0334]</name>
<name>Suspicious Nvidia Signed module was dropped [E0464]</name>
<name>Suspicious Nvidia Signed module was loaded [E0465]</name>
<name>Explorer.exe Loading Suspicious .Net Assembly [E0472]</name>
<name>Suspicious Compromised Process Loading .Net CLR DLL [E0473]</name>
<name>Rundll32 loaded DLL with unusual extension [F0461]</name>
<name>Windows Print Spooler loaded suspicious DLL from remote folder [A0441] </name>
<name>Suspicious LoLBaS Execution: Control.exe loading DLL from ADS (Alternate Data Streams) [E0437]</name>
<name>Suspicious DLL loaded from Alternate Data Stream [E0438]</name>

    Most likely on of these rules triggered and the hash of the file is now added to the "blocked hashes" list in the Inspect Web Console under "More > Blocked Hashes" 

    The ekrn service failed to start / Patch Tuesday Windows Updates

    in ESET Products for Windows Servers

    Posted

    You can create a dynamic group with the following condition:

    image.thumb.png.991a4affc34677b6c3b3b1bc2ed6438c.png

     

    and then create a "dynamic group changes" notification for that: 

    image.png.e59c490dd50d4c60bf1e4a04f6b639aa.png

     

    You could also trigger the previously mentioned "run command" task using a joined dynamic group trigger or scheduled trigger on that group to "auto heal" affected systems. (but as previously mentioned, A reboot is probably preferred) 

    EEI version 1.9 server upgrade fails with error

    in ESET Inspect On-prem (Detection and Response)

    Posted

    I can't reproduce this behavior on my test system, but had a look with Promon, at some point the installer creates the file:
    C:\Users\username\AppData\Local\Temp\2\ESE9EA6.tmp\ServerApi.dll

    Could it be that some other process is preventing the installer from either writing this file or loading the dll? 

    Maybe creating a procmon capture during the installation attempt can shed some more light on what's going on. 
    Also msi install log might have some additional clues about why it is failing.  (if log file is not created, try running the installer with: msiexec /i ei_server_nt64.msi /lvx*! ei.install.log)

    The ekrn service failed to start / Patch Tuesday Windows Updates

    in ESET Products for Windows Servers

    Posted · Edited by Mitchell

    3 minutes ago, Sec-C said:

    We tried starting the eset service manually on ~10 machines.  There where no more obvious errors afterwards. We have not tried additional reboots, since we need the machines online. Is there a way to make the agent try starting the security product?

    Managed to get the service started by run-command task from ESET PROTECT with command: 

    net start "ESET Service"

     this was only on a test VM though, uncertain if there are any unwanted side effects.  

    User synchronization task errors

    in ESET Inspect On-prem (Detection and Response)

    Posted

    The task is used to synchronize users from AD, mainly to show some additional info about the user triggering a detection, specifically the following fields when viewing a detection in INSPECT: (the fields in AD are empty in my case, so that's why the values are 'unkown') 

    image.png.56dc527dbc6f678c98d2529498e10fbd.png

    A possible work-around is to delete all 'computer users' from ESET PROTECT (if you are not using this functionality) after that sync task should work again, but I have seen the issue come back.  

     

    If you don't care about the above information in the detection events, I would ignore the failing of the task, as it is not critical functionality. 

     

    ESET API - List computers

    in ESET PROTECT On-prem (Remote Management)

    Posted · Edited by Mitchell
    fixed typo's

    This should give you: staticgroup_name,computer_name,computer_uuid:

      

    {
    "Era.Common.NetworkMessage.ConsoleApi.Reports.RpcGenerateReportRequest": {
        "reportTemplate": {
            "data": {
                "query_usage_definition_id": 21,
                "used_symbol": [
                    {
                        "column_id": 673,
                        "symbol_id": 673,
                        "aggregation_parameter": {}
                    },
                    {
                        "column_id": 657,
                        "symbol_id": 657,
                        "aggregation_parameter": {}
                    },
                    {
                        "column_id": 644,
                        "symbol_id": 644,
                        "aggregation_parameter": {}
                    }
                ]
            },
            "rendering": {
                "draw_chart": False,
                "draw_table": True,
                "table": {
                    "type_id": 100,
                    "columns": [
                        {
                            "column_id": 673,
                            "order": 0,
                            "width": 1,
                            "label": {"type": 1, "literal": "staticgroup_name"}
                        },
                        {
                            "column_id": 644,
                            "order": 0,
                            "width": 1,
                            "label": {
                                "type": 1,
                                "literal": "computer_name"
                            }
                        },
                        {
                            "column_id": 657,
                            "order": 0,
                            "width": 1,
                            "label": {"type": 1, "literal": "computer_uuid"}
                        }
                    ]
                }
            }
        }
    }
}

     

    Example output:

      

    {
	'Era.ServerApi.ReportCSVResponse': {
		'reportCSV': 
			'staticgroup_name,computer_name,computer_uuid
			Lost & found,desktop-vhqqkoh,3752aa8e-2675-471c-9e61-474f2fbd7eea
			Lost & found,exchange.lab.local,178a0124-b66d-426b-8097-fb3261146eed
			Lost & found,azca.lab.local,c6ef236f-6db7-4873-9e0a-14487ac9c10b
			Domain Controllers,azdc01.lab.local,e6f28980-eae2-49d9-85f7-db30b7042931
			Desktops,azwin10-02.lab.local,8737171e-408a-4b82-a006-a31a3c51c368
			Servers,eei663777.lab.local,cd3814d2-ec00-4a43-8da2-652df3491c6f
			Servers,localhost,4b61b044-1f82-454d-9806-b54dfa838a14
			Klant A,henks-mac.local,1397d5b6-ed44-4a40-ba8d-3b78a4a692b2
			Klant A,iPhone,00029835-70ca-4b37-a7bc-86849556c23e
			Klant A,Android,0002c0b5-0a49-41ab-a4c0-5c2d01be2d1a
			Klant A,henks-mac.local,2b16e91c-1497-4e6f-8c01-21f6a2c52f5a'
	}
}

     

×
×
  • Create New...