Illegal API Use class type

The Illegal API Use class type prevents illegal use of the Exploit Prevention API.

Note

Exploit Prevention is not supported in the ARM architecture.

"{FAC7A6FB-0127-4F06-9892-8D2FC56E3F76}" 

Use this class to create a custom killbit signature. The killbit is a security feature in web browsers and other applications that use ActiveX. A killbit specifies the object class identifier (CLSID) for ActiveX software controls that are identified as security vulnerability threats. Applications that use ActiveX don't load specified ActiveX software with a corresponding killbit in place.

The primary purpose of a killbit is to close security holes. Killbit updates are typically deployed to Microsoft Windows operating systems using Windows security updates.

Here is an example of a killbit signature:

Rule { 
tag "Sample4"
Class Illegal_API_Use
Id 4001
level 4
Executable { Include "*"}
user_name { Include "*"}
vulnerability_name {Include "Vulnerable ActiveX Control Loading ?"}
detailed_event_info { Include
"0002E533-0000-0000-C000-000000000046"\"0002E511-0000-0000-C000-000000000046"}
directives files:illegal_api_use:bad_parameter illegal_api_use:invalid_call
attributes -not_auditable
}