Expert Rule syntax to protect registry

To write an expert rule to protect your registry, you need to ensure that it follows the correct syntax. Expert rules consist of process, one or more targets, and the matching conditions that rules must examine before allowing the source to access the registry.

Note
Exploit Prevention is not supported in the ARM architecture.

Here is a sample Expert rule for registry rule type and their respective definitions:

Caution
Expert Rule commands are case-sensitive.

Rule {
	Process {
		Include OBJECT_NAME {
			-v regedit.exe  
		}
	}
	Target {
		Match KEY {
			Include OBJECT_NAME {
				-v "HKLMS\\test**"
			}
		Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"
		}
	}
}

For more Expert rules examples, visit the GitHub repository.

To add more commands in Expert rules, see Learn Expert Rules commands for Files, Processes, and Registry.

Sections of Expert Rule syntax in detail

The above Expert rule syntax is described here:

Rule

Formulates the execution of commands defined within Process and Target.

Process

Executes the set of actions defined within the Include and Exclude commands. It does not take any other commands.

Include OBJECT_NAME {
		-v regedit.exe

Include command defines the Match types. These match types are supported for the Registry rule type:

ACCESS_MASK
AUTHENTICATION_ID
NT_ACCESS_MASK
OBJECT_NAME
OS_VERSION
REGVAL_DATA

For example, the OBJECT_NAME match type is uses here to specify the name of interface object, regedit.exe, the Registry Editor.

For more information, see Object name guidelines and Match types values.

Target

Defines the target matches for the rule. This command takes no arguments and can contain only Match commands. A rule must contain at least one or more Target commands.

Match KEY

Defines an object, that an Expert rule is intended to protect and to match an event. This command requires at lease one match object type value. For registry rule type, KEY and VALUE are the match object type values.

			Include OBJECT_NAME {
				-v "HKLMS\\test**"

This section defines the target object name, that is, registry key path. These root keys are recognized:

Key	Matches
HKLM	HKLM is equivalent to HKEY_LOCAL_MACHINE.
HKCU	All user registry keys (not just the current user) and the .default user key. HKCU is equivalent to: HKEY_CURRENT_USER HKEY_USERS Note Matching against specific user SIDs is not supported.
HKCUC	All user classes (HKCU/*_CLASSES).
HKCR	System classes and all user classes (HKCU/*_CLASSES). HKCR is equivalent to HKEY_CLASSES_ROOT.
HKCCS	HKLM/SYSTEM/CurrentControlSet HKLM/SYSTEM/ControlSet00X
HKLMS	HKLM/Software on 32-bit and 64-bit systems HKLM/Software/Wow6432Node on 64-bit systems only
HKCUS	HKCU/Software on 32-bit and 64-bit systems HKCU/Software/Wow6432Node on 64-bit systems only
HKULM	HKLM HKCU
HKULMS	HKLMS HKCUS
HKALL	HKLM HKU

Note
If the rule specifies a name where the root starts or contains a wild character, the AAC code performs no name normalization and that name might never match correctly. For example, **\mcshield\start is a valid name, but H*L*\mcshield\start is not.

HKEY_CURRENT_CONFIG is not supported.

		Include -access "CREATE WRITE DELETE REPLACE_KEY RESTORE_KEY"

Defines the access flags. This flag applies when the protected registry key or value is accessed. The registry rule type supports these access flags:

CREATE
DELETE
ENUM
LOAD_KEY
QUERY
READ
RENAME
REPLACE_KEY
RESTORE_KEY
WRITE

To know more about the access flags, refer ACCESS_MASK flags.

For more Expert Rules examples, visit the Trellix Github repository.