McAfee HISCDE-AB-IA Product Guide - Page 120

Windows class Services

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 120 highlights

Appendix A - Writing Custom Signatures and Exceptions Windows custom signatures level 4 values { Include "\\REGISTRY\\MACHINE\SYSTEM\\ControlSet\\Control\\Lsa\\abc" } application { Include "*"} user_name { Include "*" } directives registry:delete } The various sections of this rule have the following meaning: • Class Registry: indicates that this rule relates to requests send to IIS. • Id 4001: Assigns the ID 4001 to this rule. If the custom signature had multiple rules, every one of these rules would need to use the same ID. • level 4: Assigns the severity level 'high' to this rule. If the custom signature had multiple rules, every one of these rules would need to use the same level. • values { Include "\\REGISTRY\\MACHINE\SYSTEM\\ControlSet\\Control\\Lsa\\abc" }: Indicates that the rule monitors registry value abc under registry key "\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa . If the rule covers multiple values, add them in this section in different lines. • application { Include "*"}: Indicates that this rule is valid for all processes. If you want to limit your rule to specific processes, spell them out here, complete with path name. • user_name { Include "*" }: Indicates that this rule is valid for all users (or more precisely, the security context in which a process runs). If you want to limit your rule to specific user contexts, spell them out here in the form Local/user or Domain/user. See Common Sections for details. • directives registry:delete: Indicates that this rule covers deletion of a registry key or value. Windows class Services The following table lists the possible sections and values for the Windows class Services: Section Class Id level time user_name Executable services display_names directives Values Registry See Common sections. Notes Name of the service which is the One of the required parameters. The name of a subject of the operation creating service is found in the registry under the instance HKLM\SYSTEM\CurrentControlSet\Services\. See Note 1. Display name of the service One of the required parameters.This name appears in the Services manager. See Note 1. services:delete Deletes a service. services:create Creates a service. services:start Starts a service. 120 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
level 4
values { Include “\\REGISTRY\\MACHINE\SYSTEM\\ControlSet\\Control\\Lsa\\abc” }
application { Include “*”}
user_name { Include “*” }
directives registry:delete
}
The various sections of this rule have the following meaning:
•
Class Registry: indicates that this rule relates to requests send to IIS.
•
Id 4001: Assigns the ID 4001 to this rule. If the custom signature had multiple rules, every
one of these rules would need to use the same ID.
•
level 4: Assigns the severity level ‘high’ to this rule. If the custom signature had multiple
rules, every one of these rules would need to use the same level.
•
values { Include “\\REGISTRY\\MACHINE\SYSTEM\\ControlSet\\Control\\Lsa\\abc” }: Indicates
that the rule monitors registry value abc under registry key
“\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa . If the rule covers multiple
values, add them in this section in different lines.
•
application { Include “*”}: Indicates that this rule is valid for all processes. If you want to
limit your rule to specific processes, spell them out here, complete with path name.
•
user_name { Include “*” }: Indicates that this rule is valid for all users (or more precisely,
the security context in which a process runs). If you want to limit your rule to specific user
contexts, spell them out here in the form Local/user or Domain/user. See
Common Sections
for details.
•
directives registry:delete: Indicates that this rule covers deletion of a registry key or value.
Windows class Services
The following table lists the possible sections and values for the Windows class Services:
Notes
Values
Section
Registry
Class
See
Common sections
.
Id
level
time
user_name
Executable
One of the required parameters. The name of a
service is found in the registry under
Name of the service which is the
subject of the operation creating
the instance
services
HKLM\SYSTEM\CurrentControlSet\Services\. See
Note 1.
One of the required parameters.This name
appears in the Services manager. See Note 1.
Display name of the service
display_names
Deletes a service.
services:delete
directives
Creates a service.
services:create
Starts a service.
services:start
Appendix A — Writing Custom Signatures and Exceptions
Windows custom signatures
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
120