What is a HIPS?
A host-based intrusion prevention system (HIPS) is an agent on a single computer that watches what happens on it and steps in when an action looks like an attack. Where a HIDS only reports, a HIPS can refuse a file write, kill a process, drop a network connection or stop one program from tampering with another. That makes it a preventive control as well as a detective one. Standalone HIPS products were once common; today the same protections usually ship inside endpoint protection and EDR suites.
How a HIPS decides what to block
- Behavior rules: actions that are suspicious whichever program performs them, such as writing code into another process's memory, reading credential material from
lsass.exe, or an Office application launching a script host. - Protected resources: rules that refuse changes to critical files, registry keys and services unless the change comes from an approved installer.
- Exploit and network signatures: patterns for known attacks arriving at the host, matched after the host has decrypted the traffic.
- Policy: some products also restrict which programs may run or open network connections, overlapping with application control and the host firewall.
Example: host-based blocking on Windows
Microsoft Defender's attack surface reduction (ASR) rules are a built-in example of host-based prevention. An administrator turns on the rule that stops Office applications from creating child processes, starting in audit mode to see what it would break:
Add-MpPreference -AttackSurfaceReductionRules_Ids <rule GUID> -AttackSurfaceReductionRules_Actions AuditMode
In audit mode, matches are logged as event 1122 in the Microsoft Defender operational log. After a week with no legitimate hits, the action is switched to Enabled. From then on, when a user opens a weaponized document and its macro tries to start PowerShell, the launch is blocked, event 1121 is logged and the user sees a notification. In most environments the rules are deployed centrally through Intune or Group Policy rather than typed on each machine.
The cost of prevention: false positives
Because a HIPS acts on its own, a wrong decision stops real work. A backup agent that touches thousands of files, a monitoring tool that reads process memory, or a finance macro that launches a helper program can all resemble attacks. The usual approach is to deploy new rules in audit or learning mode, review what would have been blocked, add narrow exclusions and then enforce. Every exclusion is a gap an attacker could use, so exclusions should be specific, such as one path signed by one publisher rather than a whole folder, and reviewed regularly. Tamper protection matters too, because malware that gains administrator rights often tries to switch the agent off.
HIPS vs. HIDS, NIPS and antivirus
- HIDS: the same view of the host, but it only alerts.
- NIPS: sits inline on the network and blocks traffic for many hosts, but cannot see local process activity or payloads inside encrypted sessions.
- Antivirus: mainly identifies malicious files. A HIPS judges actions, so it can stop an exploit that never writes a malware file to disk.
- Host firewall: filters connections by address, port or program; it does not watch what processes do.
HIPS on the CompTIA Security+ exam
Host-based intrusion prevention is one of the endpoint controls listed under SY0-801 objective 4.1, and HIPS is on the exam's acronym list. Wording such as block the exploit on the server itself, prevent unauthorized changes to system files or stop a process from injecting code into another points to a HIPS. Pick a HIDS instead when the scenario says alert without blocking or warns that nothing may interrupt the application. A NIPS is the distractor when the attack never crosses a network sensor, and antivirus is the distractor when no known malware file is involved.