Sections that are common to all class types

Use these sections when defining rules of all class types.

Note
Exploit Prevention is not supported in the ARM architecture.

All section names are case sensitive. Section values are not case sensitive.

For sections that apply to a specific class type only, see the section lists for that class type.

Section	Value	Description	Required?
user_name	{Include/Exclude user's name or system account}	Specifies the users that rule applies to. Specify particular users or all users. Local users: `machine name`/`local user name` Domain users: `domain name`/`domain user name` Local system: Local/System Some remotely initiated actions don't report the ID of the remote user, but use the local service and its user context instead. You must plan accordingly when developing rules. When a process occurs in the context of a Null Session, the user and domain are "Anonymous". If a rule applies to all users, use the * wildcard.	Yes
Executable	{Include/Exclude file path name, fingerprint, signer, or description}	Specifies the executables that the rule applies to. Specify each executable inside brackets using: -path — File path name -hash — MD5 hash -sdn — Signer -desc — Description Each section can have multiple brackets and, inside the brackets, one or more options. The `-path`, `-sdn`, and `-desc` values are strings and must be Tcl-escaped if they contain spaces or other Tcl-reserved characters. The `-hash` value is a 32-character hexbin string. For example: Executable { Include -path "C:\\Program Files (x86)\\McAfee Endpoint Security\\ Threat Prevention\\mfetp.exe" -sdn "CN=\"McAfee, Inc.\", OU=Engineering, O=\"McAfee, Inc.\", L=Santa Clara, ST=California, C=US" -desc "on-access scanner service" } If a rule applies to all executables, use the * wildcard.	Yes
directives	operation type	Specifies the class-dependent operation types. For the operation type, see the directives in each class type description.	Yes
dependencies	{Include/Exclude “ID of a rule”}	Defines dependencies between rules and prevents triggering dependent rules. Add the dependencies section to prevent a more general rule from being triggering with a more specific rule. For example, use ID 428 for Buffer Overflow signatures.	No
attributes	-no_log	Sends no events from the signature to the Trellix ePO - On-prem server. Sends no events from the signature.	No
	-not_auditable	Generates no exceptions for the signature when Adaptive mode is enabled.
	-no_trusted_apps	Specifies that the trusted application list doesn't apply to this signature.
	-inactive	Disables the signature.