Protect files, registry, processes, and services with Access Protection rules

Select Menu → Policy → Policy Catalog, then select Endpoint Security Threat Prevention from the Products list in the left pane.

From the Category list in the right pane, select Access Protection.

Click the Edit link for an editable policy.

Click Show Advanced.

Change a Trellix-defined rule: In the Rules section, select the rule, then click Edit.

1. On the Rule page, configure rule options.

2. In the Executables section, click Add, configure executable properties, then click Save twice to save the rule.

Create a custom rule: In the Rules section, click Add.

1. On the Rule page, configure the settings.

2. In the Executables section, click Add, configure executable properties, then click Save. An empty Executables table indicates that the rule applies to all executables.

3. In the User Names section, click Add, configure user name properties, then click Save.

4. In the Subrules section, click Add, then configure subrule properties.

   Note

   With Microsoft Window 8.1 and later, Access Protection rules no longer support operations for the Services subrule type. This is because Microsoft made services.exe a protected process in Windows 8.1 and later.

5. In the Targets section, click Add, configure target information, then click Save three times.

Specify the behavior of the rule: In the Rules section, select Block, Report, or both for the rule.

Click Save.