Prevent file creation in a network path

This example rule prevents cmd.exe from creating files in a network path.

Note

Exploit Prevention is not supported in the ARM architecture.

Rule {
	Process {
		Include OBJECT_NAME { -v cmd.exe  }
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { -v ** }
   Include -file_properties "FILE_NETWORK"
   Include -access "CREATE"
		}
	}
}

For more Expert Rules examples, visit the Trellix Github repository.