cancel
Showing results for 
Search instead for 
Did you mean: 
smalldog
Level 12

Block application with HIPS8

Jump to solution

Hi All, in Hips7 i can block application from running but HIPS8 i can not, anybody tell me how to do that with HIPS? Thanks for advance!

0 Kudos
1 Solution

Accepted Solutions
McAfee Employee

Re: Block application with HIPS8

Jump to solution

Host IPS 8.0 can do it.   An example is posted in:

KB71329 - How to blacklist applications using a Host Intrusion Prevention 8.0 custom signature

Signatures 6010 and 6011 will block all untrusted applications and you will need to write IPS exceptions for applications that are "approved" for your environment (basically whitelisting).

0 Kudos
12 Replies
smalldog
Level 12

Block application with HIPS8

Jump to solution

So HIPS 8 can not do that? hix. Must install HIPS 7 or use Application Control (Solidcore).

0 Kudos
dyilmaz
Level 9

Block application with HIPS8

Jump to solution

Well you could make use of Signature 6010 and 6011 which will "blacklist" all untrusted processes from launching other programs or hooking into other processes.

When in use you could define excludes for the signatures or use Trusted Applications

0 Kudos
smalldog
Level 12

Block application with HIPS8

Jump to solution

Hi Dyilmaz, can you tell me how to use that to protect applications or any guides for that? Thanks!

0 Kudos
casscoss
Level 7

Block application with HIPS8

Jump to solution

Any examples or solutions for this??? I have the same issue

0 Kudos
McAfee Employee

Re: Block application with HIPS8

Jump to solution

Host IPS 8.0 can do it.   An example is posted in:

KB71329 - How to blacklist applications using a Host Intrusion Prevention 8.0 custom signature

Signatures 6010 and 6011 will block all untrusted applications and you will need to write IPS exceptions for applications that are "approved" for your environment (basically whitelisting).

0 Kudos
casscoss
Level 7

Re: Block application with HIPS8

Jump to solution

Awesome!!! Thanks Kary!!! You just saved my day...no make it week!!!

0 Kudos
smalldog
Level 12

Re: Block application with HIPS8

Jump to solution

Hi all, now i can not block specifies applications with signatures 6010 and 6011. I think two signatures that block applications from launching other programs or hooking into other processes but can not block themself. For example I want to block msmsgs.exe (MSN) from running but can not do that. Could you help me to create rules to block specifies from run? Thanks!

0 Kudos
cyclone3d
Level 7

Re: Block application with HIPS8

Jump to solution

The link to the article doesn't work anymore.

I have tried the instructions here : https://kc.mcafee.com/corporate/index?page=content&id=KB71794&act=RATE&impressions=false&newguid=021...

And using the description doesn't work (under file properties/details) and I don't see any way to get the MD5 hash of the program I want to block through mcafee.

0 Kudos
McAfee Employee

Re: Block application with HIPS8

Jump to solution
Hi all, now i can not block specifies applications with signatures 6010 and 6011

Signatures 6010 and 6011 (and appropriate IPS exceptions) are used for whitelisting applications.  If you wish to block specific applications, you'll need a custom signature.  See the KB below.  As cyclone3d stated, the second KB article below discusses Application Blocking functionality in HIPS 8.0.

Corrected link:

KB71329 - How to blacklist applications using a Host Intrusion Prevention 8.0 custom signature

KB71794 -

How to configure application blocking/hooking functionality with Host Intrusion Prevention 8.0