Jump to content

vanroy

Members
 View Profile  See their activity

  • Posts

    118

  • Joined

 Content Type 

Posts posted by vanroy

    Search URL or IP

    in ESET Inspect

    Posted

    Hello,

    It is possible to see the URL or IP from site not listed as malicious and the endpoint downloaded malware from this site.
    ESET Inspect only see the executions.

    With other XDR this is possible.

     thank you.

    Exclusion for CreateProcess

    in ESET Inspect

    Posted

    Hello,

    what is bad?

    <definition>
        <parentprocess>
            <operator type="AND">
                <operator type="OR">
                    <condition component="FileItem" property="FileName" condition="is" value="php-cgi.exe" />
                    <condition component="FileItem" property="FileName" condition="is" value="php.exe" />
                </operator>
                <condition component="FileItem" property="Path" condition="starts" value="c:\php\" />
            </operator>
        </parentprocess>
        <process>
            <operator type="AND">
                <condition component="Module" property="SignatureType" condition="greaterOrEqual" value="90" />
                <operator type="OR">
                    <condition component="FileItem" property="FileName" condition="is" value="cmd.exe" />
                    <condition component="FileItem" property="FileName" condition="is" value="conhost.exe" />
                </operator>
                <operator type="OR">
                    <condition component="FileItem" property="Path" condition="starts" value="%SYSTEM%" />
                    <condition component="FileItem" property="Path" condition="starts" value="%WINDIR%\syswow64\" />
                </operator>
                <condition component="Module" property="SignerName" condition="is" value="Microsoft Windows" />
            </operator>
        </process>
        <operations>
            <operation type="CreateProcess">
                <operator type="and">
                    <condition component="FileItem" property="FullPath" condition="is" value="c:\php\php.exe" />
                    <condition component="FileItem" property="FullPath" condition="is" value="c:\php\php-cgi.exe" />
                </operator>
            </operation>
        </operations>
    </definition>

     

     

     

     

     

    Screenshot 2023-06-21 at 11.22.23 AM.png

    Screenshot 2023-06-21 at 11.22.50 AM.png

    Screenshot 2023-06-21 at 11.23.37 AM.png

    Screenshot 2023-06-21 at 11.44.35 AM.png

    Detection by Endpoint Security alerts

    in ESET Inspect On-prem (Detection and Response)

    Posted

    On 2/8/2021 at 4:16 PM, Lockbits said:

    Hello guys,

    I've two suggestions:

    1) The option to apply exclusions for web control detections or "Detected by ESET Endpoint Security product" alerts. We've a customer that is using web control and we configured the product so all blocked websites are logged in EPC console setting the verbosity accordingly. The problem is that this information is also sent to EEI console and this add a ton of unnecessary data and difficult the detection of valuable data. We can disable the verbose level but this will also affect the blocked website being logged and reported to ESMC.

    I mean this:

    image.png.5ebf9273ad698cb9e31c7e8f4b06df89.png

     

    Hello, 

    How have you resolved this?

    "Detected by ESET Endpoint Security product" alerts

     

    best.

    Login failed: UserInfoProvider: ESET Protect Server not available

    in ESET Inspect On-prem (Detection and Response)

    Posted

    Hello,

    Have issue w/ ESET Enterprise Inspector to login result "Login failed: UserInfoProvider: ESET Protect Server not available" 

    it was working fine and the user password is correct. after 1 day the issue persist!

    All services ESET protect and ESET Enterprise Inspector working!

    ESET protect and ESET Enterprise Inspector Installation is on the same server!

     

    On the log EEI see!

    2022-03-31 14:29:33 02e0c Info: 2022-03-31 09:49:27 - audit(00000000-0000-0000-0000-000000000000 Login attempt Forbidden [User=Administrator])
    2022-03-31 14:29:33 02e0c Info: 2022-03-31 10:24:04 - audit(00000000-0000-0000-0000-000000000000 Login attempt Forbidden [User=Administrator])
    2022-03-31 14:29:33 02e0c Info: 2022-03-31 10:24:27 - audit(00000000-0000-0000-0000-000000000000 Login attempt Forbidden [User=Administrator])
    2022-03-31 14:29:33 02e0c Info: 2022-03-31 10:25:08 - audit(00000000-0000-0000-0000-000000000000 Login attempt Forbidden [User=Administrator])
    2022-03-31 14:29:33 02e0c Info: 2022-03-31 10:25:36 - audit(00000000-0000-0000-0000-000000000000 Login attempt Forbidden [User=Administrator])
    2022-03-31 14:29:33 02e0c Info: 2022-03-31 14:21:23 - audit(00000000-0000-0000-0000-000000000000 Login attempt Forbidden [User=Administrator])
    2022-03-31 14:29:33 03654 Info: ESET Protect: there was a problem while connecting to ESET Protect Server. User was blocked. Please try again later.
    2022-03-31 14:29:33 0352c Info: ESMCMachinesMetadataSyncTask: Failed requesting static groups/machines metadata/alerts. User was blocked. Please try again later.
    2022-03-31 14:29:33 03654 Info: ESET Protect: there was a problem while connecting to ESET Protect Server. User was blocked. Please try again later.
    2022-03-31 14:29:33 02e0c Error: ESMCAuditExportTask: Error occurred while exporting audit to ESMC. User was blocked. Please try again later.
    2022-03-31 14:29:33 00410 Error: ESMC: failure to authenticate during alarm export. User was blocked. Please try again later.
    2022-03-31 14:29:33 03654 Error: ERADetectionEventsSyncTask: Failed to export alarms. User was blocked. Please try again later.

     

    On the ESET protect trace log see

    2022-03-31 19:01:33 Error: ConsoleApiModule [Thread 36bc]: 1383 Error while sending AuthenticateUser request [UserName=Administrator] CUserAccessLimiter::CheckAccess(): User Administrator from ipserver was blocked.
    2022-03-31 19:01:40 Error: CServerSecurityModule [Thread b4]: CUserAccessLimiter::CheckAccess(): User Administrator from ipserver was blocked.
    2022-03-31 19:01:40 Error: ConsoleApiModule [Thread 36bc]: 1383 Error while sending AuthenticateUser request [UserName=Administrator] CUserAccessLimiter::CheckAccess(): User Administrator from ipserver was blocked.
    2022-03-31 19:01:40 Error: CServerSecurityModule [Thread b4]: CUserAccessLimiter::CheckAccess(): User Administrator from ipserver  was blocked.
    2022-03-31 19:01:40 Error: ConsoleApiModule [Thread 36bc]: 1384 Error while sending AuthenticateUser request [UserName=Administrator] CUserAccessLimiter::CheckAccess(): User Administrator from ipserver was blocked.

    Any ideas for check? 

     

    Eset Endpoint v8.1 LiveGrid connection problem

    in ESET Endpoint Products

    Posted

    On 10/19/2021 at 8:39 AM, Marcos said:

    Please switch to the pre-release update channel to download Direct Cloud Communication module 1122 which contains a logic for cases when DNS resolution is failing through all available name servers like in your case when CloudFlare name servers were used. Let us know if it resolves the issue for you. The module will be released for general public in a couple of days.

    Hi 

    Cloud Communication module 1122 is only for EES 8.1 or all Business solutions for windows? 

×
×
  • Create New...