Manage users from creating symbolic links and junctions

You can block non-privileged users or allow specific users from creating the symbolic links (symlinks) and junctions through cmd.exe, powershell.exe, or powershell_ise.exe by enforcing an Expert Rule using ePO.

Before you begin

Identify the Security Identifiers (SID) groups or users that should be blocked or allowed to create symbolic links and junctions, in accordance with your corporate security policies. For more information about SID, refer Security identifiers on Microsoft's documentation.
To allow the blocked users, ask them to run whoami/groups command in the Windows command prompt and know the SID groups they belong to.
The Expert rule shown in this page is generic and covers the following permissions. For more information about security groups, refer Security identifiers on Microsoft's documentation.
- System and High permissions — The groups that are allowed to run processes at Administrator permission level.
- Medium and Low permissions — The groups that are allowed to run limited processes at Standard user and guest user level.

Task

Select Menu → Policy → Policy Catalog, then select Endpoint Security Threat Prevention from the Products list in the left pane.
From the Category list in the right pane, select Exploit Prevention.
Click the Edit link for an editable policy.
Click Show Advanced.
In the Signatures section, click Add Expert Rule.
In the Expert Rules Properties page, specify the following fields.
ENS assigns the ID number for the rule automatically starting with 20000.
1. Enter Rule name.
2. Select Severity.
  Trellix recommends selecting High severity for initial validation.
3. Select Action.
  Trellix recommends selecting Report action for initial validation. You can select Block and Report check boxes after validating that the rule works appropriately.
4. Select the Use Expert Rule template checkbox. This populates a template rule in the Rule content box based on the Rule type you select.
5. Select Files in the Rule type drop-down list.
6. Analyze which SID groups are appropriate to have permissions to create symbolic links and junctions, in accordance with your corporate security policies. Then, change the template code as shown here.
- To allow specific users or groups, add their SID within Exclude AggregateMatch.
- To block specific users or groups, remove their SID or do not mention their SIDs within Exclude AggregateMatch.
Important
Make sure to validate this Expert rule on a client test system before enforcing wider.
```
Rule {
    Process {
        Include OBJECT_NAME { -v cmd.exe }
        Include OBJECT_NAME { -v powershell.exe }
        Include OBJECT_NAME { -v powershell_ise.exe }

        # exclude admin groups
        Exclude AggregateMatch {
            Include GROUP_SID { -v "S-1-16-12288" }
            Include GROUP_SID { -v "S-1-16-16384" }
        }
    }
    Target {
        Match FILE {
            Include -access SET_REPARSE
        }
    }
}
```
In this rule, the High Mandatory Level (S-1-16-12288) and System Mandatory Level (S-1-16-16384) Security IDs are included within the Exclude AggregateMatch section. This blocks the non-privileged users and runs the process at administrative and system integrity level.
Save the rule, then save the settings.
Validate the new Expert Rule on the client system.
Enforce the policy on a client system.

For more Expert Rules examples, visit the Trellix Github repository.