kamiran.asia 5 Posted June 12, 2021 Share Posted June 12, 2021 (edited) Hi dears. We have problem with HIPS registry rules in services : We create a HIPS block rule to prevent modification in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR\Start But it seems that ESET can not apply HIPS registry rules in this address. it seems that any rule apply to HKEY_LOCAL_MACHINE\SYSTEM\ will not work. ESET Version : Endpoint Security 8.0.2028.0 - Windows 10 Edited June 12, 2021 by kamiran.asia Link to comment Share on other sites More sharing options...
Solution itman 1,659 Posted June 12, 2021 Solution Share Posted June 12, 2021 (edited) For registry subordinate keys under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\", you need to code the following, "HKEY_LOCAL_MACHINE\SYSTEM\*\". For example: HKEY_LOCAL_MACHINE\SYSTEM\*\Services\USBSTOR\Start Edited June 12, 2021 by itman kamiran.asia 1 Link to comment Share on other sites More sharing options...
kamiran.asia 5 Posted June 12, 2021 Author Share Posted June 12, 2021 8 minutes ago, itman said: For registry subordinate keys under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\", you need to code the following, "HKEY_LOCAL_MACHINE\SYSTEM\*\". For example: HKEY_LOCAL_MACHINE\SYSTEM\*\Services\USBSTOR\Start Completely Correct and worked !! Special thanks to @itman Link to comment Share on other sites More sharing options...
Recommended Posts