Sample Expert Rule to prevent Buffer Overflow

To write an expert rule to prevent buffer overflow exploits, you need to ensure that it follows the correct syntax. This rule type is built based on the legacy McAfee Host IPS.

Note
Exploit Prevention is not supported in the ARM architecture.

Here is a sample Expert rule for buffer overflow rule type and their respective definitions:

Caution
Expert Rule commands are case-sensitive.

Rule {
   time {Include "*"}
   application {Include "*"}
   user_name {Include "*"}
   attributes -no_trusted_apps -not_auditable
   directives "-d" "-c" "bo:stack" "bo:heap"
}

To add more commands in Expert rules, see Learn Expert Rules commands for Buffer overflow, Illegal API use and Services.

Sections of Expert Rule in detail

The above Expert rule is described here:

Rule	Formulates the execution of the defined commands.
time {Include "*"}	A section works based on the value mentioned in the `Include` keyword. For more information, see Include and Exclude keywords.
application {Include "*"}	Indicates that this rule is valid for all processes. To limit the rule to specific processes, list the pathname to each process.
user_name {Include "*"}	Indicates that this rule is valid for all users (or more precisely, the security context in which a process runs). To limit the rule to specific user contexts, list them using the form Local/user or Domain/user.
attributes -no_trusted_apps -not_auditable	Defines an object, that an Expert rule is intended to protect and to match an event. This command requires at lease one match object type value. For Files rule type, `FILE` is the match object type value.
attributes -no_trusted_apps -not_auditable	In this section, `-no_trusted_apps` — Specifies that the trusted application list doesn't apply to this signature. `-not_auditable` — Generates no exceptions for the signature when Adaptive mode is enabled.
directives "-d" "-c" "bo:stack" "bo:heap"	Directives add these behaviors: `bo:stack` — Examines the memory location that is executing and detects if it is running from writable memory that is part of the current thread's stack. `bo:heap` — Examines the memory location that is executing and detects if it is running from writable memory that is part of a heap. For more directives, see Buffer Overflow class type.