To write an expert rule to protect Windows Services ( Windows versions 8.0 and earlier only), you need to ensure that it follows the correct syntax. This rule type syntaxes are built based on the legacy Trellix Host IPS.
Note
Exploit Prevention is not supported in the ARM architecture.
Here is a sample Expert rule for services rule type that prevents deactivation of Alerter service:
Caution
Expert Rule commands are case-sensitive.
Rule {
services { Include "Alerter" }
application { Include "*"}
user_name { Include "*" }
directives services:stop
}To add more commands in Expert rules, see Learn Expert Rules commands for Buffer overflow, Illegal API use and Services.
Sections of Expert Rule in detail
The above Expert rule is described here:
Rule | Formulates the execution of the defined commands. |
services { Include "Alerter" } | Indicates that the rule applies to the service with name Alerter. If the rule applies to multiple services, add them in this section in different lines. |
application {Include "*"} | Indicates that this rule is valid for all processes. To limit the rule to specific processes, list the pathname to each process. |
user_name {Include "*"} | Indicates that this rule is valid for all users (or more precisely, the security context in which a process runs). To limit the rule to specific user contexts, list them using the form Local/user or Domain/user. |
directives services:stop | Indicates that this rule applies to deactivation of a service. |