McAfee HISCDE-AB-IA Product Guide - Page 119

Note 2, Advanced details, value \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\abc must

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 119 highlights

Appendix A - Writing Custom Signatures and Exceptions Windows custom signatures Note 2 The data of the section new data must be in hexadecimal. For example, the data 'def' of registry value "\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\abc" must be represented as old_data { Include "%64%65%66"}. Advanced details Some or all of the following parameters appear in the Advanced Details tab of security events for the class Registry. The values of these parameters can help you understand why a signature is triggered. GUI name Registry Key Explanation Name of the registry key affected, including the path name. Note the following: For this key HKEY_LOCAL_MACHINE\ HKEY_CURRENT_USER\ HKEY_CLASSES_ROOT\ HKEY_CURRENT_CONFIG\ HKEY_USERS\ Use this syntax \REGISTRY\MACHINE\ \REGISTRY\CURRENT_USER\ \REGISTRY\MACHINE\SOFTWARE\CLASSES\ REGISTRY\MACHINE\SYSTEM\ControlSet\HARDWARE PROFILES\0001\ \REGISTRY\USER\ Registry Values Name of the registry value concatenated with the full name of its key. Note the following: For values in this key Use this syntax HKEY_LOCAL_MACHINE\Test \REGISTRY\MACHINE\Test\* HKEY_CURRENT_USER\Test \REGISTRY\CURRENT_USER\Test\* HKEY_CLASSES_ROOT\Test \REGISTRY\MACHINE\SOFTWARE\CLASSES\Test\* HKEY_CURRENT_CONFIG\Test REGISTRY\MACHINE\SYSTEM\ControlSet\HARDWARE PROFILES\0001\Test\* HKEY_USERS\Test \REGISTRY\USER\Test\* old data new data old data type new data type Only applicable for registry value changes: data that a registry value contained before it was changed or attempted to be changed. Only applicable for registry value changes: data that a registry value contains after it was changed or that it would contain if the change went through. Only applicable for registry value changes: type of data type that a registry value contains before it was changed or attempted to be changed. Only applicable for registry value changes: type of data that a registry value would contain after it was changed or that it would contain if the change went through. The following rule would prevent anybody and any process from deleting the registry value "abc" under registry key "\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa" Rule { tag "Sample8" Class Registry Id 4001 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5 119

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
Note 2
The data of the section new data must be in hexadecimal. For example, the data ‘def’ of registry
value “\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\abc” must be
represented as old_data { Include “%64%65%66”}.
Advanced details
Some or all of the following parameters appear in the Advanced Details tab of security events
for the class Registry. The values of these parameters can help you understand why a signature
is triggered.
Explanation
GUI name
Name of the registry key affected, including the path name. Note the following:
Use this syntax
For this key
Registry Key
\REGISTRY\MACHINE\
HKEY_LOCAL_MACHINE\
\REGISTRY\CURRENT_USER\
HKEY_CURRENT_USER\
\REGISTRY\MACHINE\SOFTWARE\CLASSES\
HKEY_CLASSES_ROOT\
REGISTRY\MACHINE\SYSTEM\ControlSet\HARDWARE
PROFILES\0001\
HKEY_CURRENT_CONFIG\
\REGISTRY\USER\
HKEY_USERS\
Name of the registry value concatenated with the full name of its key. Note the following:
Use this syntax
For values in this key
Registry Values
\REGISTRY\MACHINE\Test\*
HKEY_LOCAL_MACHINE\Test
\REGISTRY\CURRENT_USER\Test\*
HKEY_CURRENT_USER\Test
\REGISTRY\MACHINE\SOFTWARE\CLASSES\Test\*
HKEY_CLASSES_ROOT\Test
REGISTRY\MACHINE\SYSTEM\ControlSet\HARDWARE
PROFILES\0001\Test\*
HKEY_CURRENT_CONFIG\Test
\REGISTRY\USER\Test\*
HKEY_USERS\Test
Only applicable for registry value changes: data that a registry value contained before it was
changed or attempted to be changed.
old data
Only applicable for registry value changes: data that a registry value contains after it was
changed or that it would contain if the change went through.
new data
Only applicable for registry value changes: type of data type that a registry value contains
before it was changed or attempted to be changed.
old data type
Only applicable for registry value changes: type of data that a registry value would contain
after it was changed or that it would contain if the change went through.
new data type
The following rule would prevent anybody and any process from deleting the registry value
“abc” under registry key “\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa”
Rule {
tag "Sample8"
Class Registry
Id 4001
Appendix A — Writing Custom Signatures and Exceptions
Windows custom signatures
119
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5