Signatures are collections of rules that compare behavior against known attacks and perform an action when a match is detected. Trellix delivers signatures in Exploit Prevention content updates.
Important
Disclaimer: This content was written in English. In the event of any differences between the English content and the translation, always refer to the English source. Some content has been translated with Google machine translation tools.
Note
Exploit Prevention is not supported in the ARM architecture.
When the Exploit Prevention content file is updated, the list of signatures is updated.
Signature types
Threat Prevention includes these signature types:
Files signatures report or block operations such as renaming or executing, on specific files, paths, or drives.
Services signatures report or block operations such as starting, stopping, or changing the startup mode, on services.
Registry signatures report or block operations such as creating or deleting, on registry keys and registry values.
Processes signatures report or block operations such as access or running, on processes.
Buffer Overflow signatures report or block malicious programs inserted into the memory space exploited by an attack.
Illegal API Use signatures report or block API calls that might result in malicious activity.
Network IPS signatures report or block malicious data that flows between the system and the rest of the network.
Note
Buffer Overflow and Illegal API Use signatures protect specific processes, which are defined in the Application Protection Rules list. When an attack is detected, Exploit Prevention can stop the behavior initiated by the attack.
Behavioral rules
Behavioral rules block zero-day attacks and enforce proper operating system and application behavior. Heuristic behavioral rules define a profile of legitimate activity. Activity not matching these rules is considered suspicious and triggers a response. For example, a behavioral rule might state that only a web server process can access HTML files. If any other process tries to access HTML files, Exploit Prevention responds with the configured action. This type of protection, called application shielding and enveloping, prevents applications and their data from being compromised and prevents applications from being used to attack other applications.
Behavioral rules also block buffer overflow exploits, preventing code execution that results from a buffer overflow attack, one of the most common methods of attack.
Actions
An action is what Exploit Prevention does when a signature is triggered.
Block — Prevents the operation.
Report — Allows the operation and reports the event.
If neither is selected, the signature is disabled: Exploit Prevention allows the operation and doesn't report the event.
The Exploit Prevention content file automatically sets the action for signatures based on severity level. Typically, signatures with a severity level of High are set to both Block and Report. You can change the action for a specific signature in the Signatures section of the Exploit Prevention settings. Any changes you make to the signature actions persist through content updates.
Note
You can't delete or otherwise change default signatures.
Severity levels
Each signature has a default severity level, which describes the potential danger of an attack.
High — Signatures that protect against clearly identifiable security threats or malicious actions. Most of these signatures are specific to well-identified exploits and are mostly non-behavioral in nature.
Caution
To prevent exposing systems to exploit attacks, set signatures with a severity of High to Block on every host.
Medium — Signatures that are behavioral in nature and prevent applications from operating outside of their environment (relevant for clients protecting web servers and Microsoft SQL Server).
Tip
Best practice: On critical servers, set signatures with a severity of Medium to Block after fine-tuning.
Low — Signatures that are behavioral in nature and shield applications. Shielding means locking down application and system resources so that they can't be changed.
Setting signatures with a severity of Low to Block increases the security of the system, but requires additional tuning.
Informational — Signatures that indicate a change to the system configuration that might create a benign security risk or an attempt to access sensitive system information. Events at this level occur during normal system activity and generally aren't evidence of an attack.
Disabled — Signatures that are disabled in the Exploit Prevention content file. A Disabled status indicates there is no severity assigned to it.
In Endpoint Security versions 10.2 and earlier, the Protection Level setting controls signature actions. If you assign an Exploit Prevention policy from Endpoint Security version 10.7 or later to client systems running an earlier version, the Protection Level doesn't change and it isn't configurable from the policy. If Protection Level was set to Standard, only high-severity signatures are detected and blocked. If Protection Level was Maximum, high-severity and medium-severity signatures are detected and blocked.
Custom signatures
You can create custom signatures, also called rules, to enhance the protection provided by the default signatures. For example, when you create a folder with important files, you can create a custom signature to protect it.
You can create:
Custom Access Protection rules to protect specific files, services, registry keys and values, and processes.
Create these rules by clicking Add in the Rules section of the Access Protection settings.
Expert Exploit Prevention Rules to prevent buffer overflow and illegal API use exploits, as well as protect files, services, registry, and processes.
Create these rules by clicking Add Expert Rule in the Signatures section of the Exploit Prevention settings.
Note
You can't create Network IPS Expert Rules.