Expert Rule syntax to protect processes

To write an expert rule to protect the Windows processes, you need to ensure that it follows the correct syntax. Expert rules consist of process, one or more targets, and the matching conditions that rules must examine before allowing the source to access the processes.

Note
Exploit Prevention is not supported in the ARM architecture.

Here is a sample Expert rule for registry rule type and their respective definitions:

Caution
Expert Rule commands are case-sensitive.

Rule {
    Process {
        Include OBJECT_NAME {
            -v "**"
        }
    }
    Target {
        Match PROCESS {
            Include OBJECT_NAME {..}            
            Include -access "DELETE TERMINATING" ; # Define access types
	           Exclude -access "CREATE"
        }
    }
}

To add more commands in Expert rules, see Learn Expert Rules commands for Files, Processes, and Registry.

Sections of Expert Rule syntax in detail

The above Expert rule syntax is described here:

Rule

Formulates the execution of commands defined within Process and Target.

Process

Executes the set of actions defined within the Include and Exclude commands. It does not take any other commands.

Include OBJECT_NAME {
    -v "**"												
    }                    
Exclude .. {..}

In this section,

The Include command involves the specified object name during processing. When you specify -v "**", all possible interfaces that users/applications can interact with Windows are involved. To be more specific, you can write the object names such as powershell.exe, or explorer.exe, or cmd.exe.
The Exclude command eliminates the defined object name while processing.

For more information, see Object name guidelines and Match types values.

Target

Defines the target matches for the rule. This command takes no arguments and can contain only Match commands. A rule must contain at least one or more Target commands.

		Match PROCESS

Defines an object, that an Expert rule is intended to protect and to match an event. This command requires at lease one match object type value.

Based on the object that needs protection, you use can one of these match object type values:

Match object_type_value	Description	Valid match object value
`PROCESS`	Controls access to an entire process handle.	Initiator Target Note If PROCESS is not used in the Initiator match, you must use THREAD.
`SECTION`	Controls access to creating a section object.	Target Note If the access to be blocked is CREATE, the object type must be SECTION rather than PROCESS.
`THREAD`	Controls access to a threat handle.	Initiator Target Note If THREAD is not used in the Initiator match, you must use PROCESS.

Include OBJECT_NAME {
  -v notepad.exe

This section defines the target object name, that is, Windows program to be secured.

	Include -access "DELETE TERMINATING"
 Exclude -access "CREATE"

During processing, the Include -access and Exclude-access commands denote the access types for the specified program. You can write multiple access types together. For example, in this code snippet:

Include -access "DELETE TERMINATING" blocks the deletion and termination of object notepad.exe.
Exclude -access "CREATE" allows the creation of process or thread.

The processes rule type supports these access types:

CREATE
DELETE
LOAD/IMAGE
TERMINATING
WRITE

To know more about the access flags, refer ACCESS_MASK flags.

For more Expert Rules examples, visit the Trellix Github repository.