ERAAgent.exe modifies SMB/Named Pipe registry configuration

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.