Prevent file creation

This example Expert rule triggers an event, when users create or access specific files in a file path, through Windows Command Prompt or File Explorer.

Note
Exploit Prevention is not supported in the ARM architecture.

These are the file names and file path used in this example: test.txt and test.dat c:\\temp\\.

Important
Make sure to test this Expert rule on a client system before enforcing wider.

Rule {
	Process {
		Include OBJECT_NAME { 
		-v cmd.exe  
		-v explorer.exe
		}
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { -v "c:\\temp\\*test.txt"}
			Include -access "CREATE"
		}
		Match FILE {
			Include OBJECT_NAME { -v "c:\\temp\\*test.dat"}
			Include -access "CREATE WRITE READ"
		}		
	}
}

Sections of Expert Rule syntax in detail

The above Expert rule is described here:

Rule	Formulates the execution of commands defined within `Process` and `Target`.
Process	Executes the set of actions defined within the `Include` and `Exclude` commands. It does not take any other commands.
Include OBJECT_NAME { -v cmd.exe -v explorer.exe }	In this section, `Include` command considers the defined object names in processing. As written in this rule, users are restricted to interact with Windows through the command prompt and File Explorer. For more information, see Object name guidelines and Match type values.
Target	Defines the target matches for the rule. This command takes no arguments and can contain only `Match` commands. A rule must contain at least one or more `Target` commands.
Match FILE	Defines an object, that an Expert rule is intended to protect and to match an event. This command requires at lease one match object type value. For Files rule type, `FILE` is the match object type value.
Include OBJECT_NAME { -v "c:\\temp\\*test.txt"} Include -access "CREATE"	In this section, `Include` command involves the file path defined within OBJECT_NAME. `Include -access "CREATE"` blocks user to create `test.txt` in `c:\\temp\\` directory.
Match FILE { Include OBJECT_NAME { -v "c:\\temp\\*test.dat"} Include -access "CREATE WRITE READ" }	As more than one file needs protection, subrules are defined in this Expert rule. Within the file directory `c:\\temp\\`, users cannot create, write, and read the file called `test.dat`.

For more Expert Rules examples, visit the Trellix Github repository.