Conventions for conditions

The following conventions apply when creating individual conditions to be used in a custom indicator rule:

Valid operators

These conditions look for activity values using the following operators:

is, equal, or matches searches for exact matches to the value you specified for the condition
contains searches for partial matches to the given information
is greater than searches for matches in which the condition value on the host is greater than the value you specified for that condition
is less than searches for matches in which the condition value on the host is less than the value you specified for the condition
is between searches for matches in which the condition value on the host falls between a range of values that you specify

File conditions

When you add a condition to monitor for a file, the resulting indicator rule searches for the presence on the host of a file that matches the values you specify for any or all of the following:

File path: equal, contains, or matches
MD5: equal
File size (in bytes): equal

Network connection conditions

When you add a condition to monitor for a network connection, your indicator rule searches for the execution of network connection activity that matches the values you specify for any or all of the following:

Local or remote (destination) IP addresses: equal
Local or remote (destination) ports: equal, is greater than, is less than, and is between
Note
The local and remote port specifications in a network connection condition cannot be zero (0). (ENDPT-176)

DNS lookup conditions

When you add a condition to monitor for a DNS lookup, the resulting indicator rule searches for the execution on the host of a value that you specify for the following:

DNS lookup: equal, contains, or matches

Regular expression conditions

Endpoint Security (HX) supports matching regular expressions (regex) in indicator rules for current implementations of RE2. You can enter operators, such as matches or contains to use regex for the condition values that you want to add to a custom indicator rule.

For example:

To find any of a set of files in a directory:

C:\\windows\\filename1|filename2|filename3

To find the same file in a set of directories:

(c:\\Windows\\|c:\\Temp\\|c:\\ Program Files)\\malwarebytes.exe)

To search in user profiles:
```
C:\\(Documents and Settings|Users)\\.*\\.*(Documents|Desktop|Downloads)\\malware.exe
```
```
C:\\(Documents and Settings|Users)\\.*malware.exe
```
The first example searches for the file malware.exe inside every user profile within the Documents, Desktop, and Downloads directories. The second example searches for the file within any file path in the Users directory.