The Include and Exclude commands specify the data used for matching.
Note
Exploit Prevention is not supported in the ARM architecture.
Description
The Include and Exclude commands take two required arguments:
MATCH_type, which determines the entries in anIncludeorExcludethat are ORed or ANDedThe actual data to match
The body of the command can contain multiple data entries. Each data entry must begin with either
-vor-l.
Syntax
Rule {
Initiator
Match {
Include MATCH_type < -type PATH > {
-v data | -l data
...
}
}
}
}Rule {
Initiator
Match {
Exclude MATCH_type < -type PATH > {
-v data | -l data
...
}
}
}
}Arguments
Argument | Description |
|---|---|
-v | Specifies to interpret the following entry as a single value. |
-l | Specifies to interpret the following entry as a Tcl list — each entry in the list is automatically broken out into its own match entry. |
-pfx | Specifies a string to prepend to all following data entries. The strings remain in effect until another |
-sfx | Specifies a string to append to all following data entries. The strings remain in effect until another |
-type PATH | Treats all entries in the body as paths and automatically removes any trailing directory separators: / or \. This is useful to avoid double separators when you are appending strings to the values with the |
Shortcuts for MATCH_type
You can use the following shortcuts instead of building the entire MATCH_type entry.
Syntax
Include/Exclude -processor_mode user|kernel
Include/Exclude -vtp_trust true|false
Include/Exclude -access access_types
The access_types value is a list of access tokens separated by a delimiter and is case insensitive. The valid delimiters are a space, tab, comma, or pipe |.
The valid access tokens are:
CLEANUP
CLOSE
CONNECT_NAMED_PIPE
CREATE
DELETE
ENUM
EXECUTE
LOAD_IMAGE
LOAD_KEY
OBJECT_EXISTS
OPEN_NAMEDSECTION
POST
QUERY
READ
REPLACE_KEY
RESTORE_KEY
SET_REPARSE
SET_SECURITY
START_DEVICE
TERMINATING
WRITE
WRITE_ATTRIBUTE