
McAfee® Host Intrusion Prevention 6.1 Product Guide | Writing Custom Signatures |
| Windows Custom Signatures |
A
time { Include “*” }: This section is currently not used, but must be included in this way in the rule.
application { Include “*”}: Indicates that this rule is valid for all processes. If you’d want to limit your rule to specific processes, you would spell them out here, complete with their path name.
user_name { Include “*” }: Indicates that this rule is valid for all users (or more precisely, the security context in which a process runs). If you’d want to limit your rule to specific user contexts, you would spell them out here in the form Local/user or Domain/user. See paragraph “Mandatory Common Sections” for details.
directives
Class Services
The following table lists the possible sections of the class Services.
section | values | meaning/remarks |
|
|
|
Class | Services |
|
|
|
|
Id | 4000 - 7999 |
|
|
|
|
level | 0, 1, 2, 3, 4 |
|
|
|
|
time | * |
|
|
|
|
user_name | user or system account |
|
|
|
|
application | path + application name |
|
|
|
|
services | name of the service | either section “services” or “display_names” |
| which is the subject of | must be used; the name of a service is found |
| the operation creating | in the registry under |
| the instance | HKLM\SYSTEM\CurrentControlSet\Services\; |
|
| see Note 1 |
|
|
|
display_names | display name of the | this name is shown in Services Control Panel; |
| service | see Note 1 |
|
|
|
directives | services:delete | Deletion of a Service |
|
|
|
| services:create | Creation of a Service |
|
|
|
| services:start | Giving a start command to a service |
|
|
|
| services:stop | Giving a stop command to a service |
|
|
|
| services:pause | Giving a pause command to a service |
|
|
|
| services:continue | Giving a continue command to a service |
|
|
|
| services:startup | Modifying the startup mode of a service |
|
|
|
| services:profile_enable | Enabling a Hardware profile |
|
|
|
| services:profile_disable | Disabling a Hardware profile |
|
|
|
| services:logon | Modifying the logon information of a service |
|
|
|
Note 1
The section service must contain the name of the service of the corresponding registry key under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.
The section display_names must contain the display name of the service, the name shown in the Services Control Panel, which is found in registry value
178