McAfee HISCDE-AB-IA Product Guide - Page 122

Windows class SQL

Get McAfee HISCDE-AB-IA - Host Intrusion Prevention PDF manuals and user guides View all McAfee HISCDE-AB-IA manuals
Add to My Manuals
Save this manual to your list of manuals

Page 122 highlights

Appendix A - Writing Custom Signatures and Exceptions Windows custom signatures The following rule would prevent deactivation of the Alerter service. Rule { tag "Sample9" Class Services Id 4001 level 4 Service { Include "Alerter" } application { Include "*"} user_name { Include "*" } directives service:stop } The various sections of this rule have the following meaning: • Class Services: indicates that this rule relates to file operations class. • Id 4001: Assigns the ID 4001 to this rule. If the custom signature had multiple rules, every one of these rules would need to use the same ID. • level 4: Assigns the severity level 'high' to this rule. If the custom signature had multiple rules, every one of these rules would need to use the same level. • Service { Include "Alerter" }: Indicates that the rule covers the service with name "Alerter". If the rule covers multiple services, add them in this section in different lines. • application { Include "*"}: Indicates that this rule is valid for all processes. If you want to limit your rule to specific processes, spell them out here, complete with path name. • user_name { Include "*" }: Indicates that this rule is valid for all users (or more precisely, the security context in which a process runs). If you want to limit your rule to specific user contexts, spell them out here in the form Local/user or Domain/user. See Common Sections for details. • directives service:stop: Indicates that this rule covers deactivation of a service. Windows class SQL The following table lists the possible sections and values for the Windows class SQL: Section Class Id level time user_name Executable authentication_mode client_agent Values MSSQL See Common sections. Notes Boolean value that specifies whether Windows authentication (set to 1) or SQL authentication (set to 0) was used. Name of the utility sending the Example: OSQL-32, Internet Information Services request on the client system. 122 McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
The following rule would prevent deactivation of the Alerter service.
Rule {
tag "Sample9"
Class Services
Id 4001
level 4
Service { Include “Alerter” }
application { Include “*”}
user_name { Include “*” }
directives service:stop
}
The various sections of this rule have the following meaning:
•
Class Services: indicates that this rule relates to file operations class.
•
Id 4001: Assigns the ID 4001 to this rule. If the custom signature had multiple rules, every
one of these rules would need to use the same ID.
•
level 4: Assigns the severity level ‘high’ to this rule. If the custom signature had multiple
rules, every one of these rules would need to use the same level.
•
Service { Include “Alerter” }: Indicates that the rule covers the service with name “Alerter”.
If the rule covers multiple services, add them in this section in different lines.
•
application { Include “*”}: Indicates that this rule is valid for all processes. If you want to
limit your rule to specific processes, spell them out here, complete with path name.
•
user_name { Include “*” }: Indicates that this rule is valid for all users (or more precisely,
the security context in which a process runs). If you want to limit your rule to specific user
contexts, spell them out here in the form Local/user or Domain/user. See
Common Sections
for details.
•
directives service:stop: Indicates that this rule covers deactivation of a service.
Windows class SQL
The following table lists the possible sections and values for the Windows class SQL:
Notes
Values
Section
MSSQL
Class
See
Common sections
.
Id
level
time
user_name
Executable
Boolean value that specifies
whether Windows authentication
authentication_mode
(set to 1) or SQL authentication
(set to 0) was used.
Example: OSQL-32, Internet Information Services
Name of the utility sending the
request on the client system.
client_agent
Appendix A — Writing Custom Signatures and Exceptions
Windows custom signatures
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
122