Trellix-defined Dynamic Application Containment rules

Accessing insecure password LM hashes

Protects the SAM file in %WINDIR%\system32\config. Windows stores passwords in this file. Programs generally don't access this file.

Best practice: Set this rule to report only (default) to monitor for potentially malicious programs or unauthorized access attempts.

Accessing user cookie locations

Protects the Internet Explorer cookies folder in %AppData%\Roaming and %AppData%\Local from change.

Best practice: Set this rule to report only (default) to monitor access to Internet Explorer cookies by contained programs.

Allocating memory in another process

Prevents contained processes from changing the memory in other processes on the system.

Changing users' data folders

Prevents contained processes from changing or executing files in the user's common data folders. Common data folders include the Desktop, Downloads, Documents, Pictures, and other locations in the AppData folder, which malware targets in ransomware attacks.

This rule can result in false positives depending on whether the contained program is truly malicious or not.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Creating a thread in another process

Prevents contained processes from creating or changing a thread in other processes on the system.

Creating files on any network location

Prevents contained processes from creating files on network locations.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Creating files on CD, floppy, and removable drives

Prevents contained processes from creating files on removable devices. Malware can use these devices to propagate.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Creating files with the .bat extension

Prevents contained applications from creating any files with the .bat extension.

If batch files are used for administrative purposes, this rule might produce false positives and impact business operations.

Best practice: If batch files aren't used to administer the system, set this rule to block and report to prevent malware from creating scripts that scripting engines execute later.

Creating files with the .exe extension

Prevents contained processes from creating any file with the .exe extension. This rule stops malware from creating executables on the system.

The typical "false blocks" that can occur with this rule might include WinZip (if users update WinZip regularly) and some installers and uninstallers.

Best practice: Run GetClean before setting this rule to block.

You can further tune this rule by using Dynamic Application Containment global exclusions.

Creating files with the .html, .jpg, or .bmp extension

Prevents contained processes from creating files with the .html, .jpg, or .bmp extension. Malware sometimes hijacks these extensions to trick the user into executing the payload.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Creating files with the .job extension

Prevents contained processes from scheduling tasks on the system. Malware actively exploits scheduled tasks to avoid behavioral scanners.

Creating files with the .vbs extension

Prevents contained processes from creating files with the .vbs (Visual Basic Script ) extension.

If .vbs files are used for administrative purposes, this rule might produce false positives and impact business operations.

Best practice: If .vbsfiles aren't used to administer the system, set this rule to block and report to prevent malware from creating scripts that scripting engines execute later.

Creating new CLSIDs, APPIDs, and TYPELIBs

Prevents contained processes from creating Class IDs, App IDs, or TypeLIBs. These registry locations can be used to register new file types and allow malware an entry point on the system.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Deleting files commonly targeted by ransomware-class malware

Prevents contained processes from deleting files that ransomware-class malware commonly targets. Ransomware sometimes tries to read the files into memory, write the file contents to a new file, encrypt it, and then delete the original. Ransomware-class malware does not typically try to directly change the files it is targeting for encryption. Instead, it uses a process already on the system, such as explorer.exe or powershell.exe, to proxy the attack. If enough attempts are blocked, the malware might fall back to trying to encrypt the file directly.

Disabling critical operating system executables

Prevents contained processes from disabling regedit or Task Manager and thus restricting administrator rights to these tools.

Executing any child process

Prevents contained processes from executing any child process on the system.

Best practice: Run GetClean before setting this rule to block.

Modifying appinit DLL registry entries

Prevents contained processes from adding entries to the appinit registry location.

User-mode processes on the system can load any entry in the appinit registry location. For this reason, malware can use these processes as an attack vector to insert its payload.

Modifying application compatibility shims

Prevents contained processes from creating application compatibility shims. Malware can use this technique to gain the same rights of the target process and inject shellcode.

Modifying critical Windows files and registry locations

Prevents contained processes from changing critical files and registry locations such as the hosts file, WINLOGON registry location, session manager registry location, and others.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Modifying desktop background settings

Prevents contained processes from changing the settings for the desktop wallpaper or background. Malware can use this technique to trick the user, hide files, or make the user think that they are clicking something else.

Modifying file extension associations

Prevents contained processes hijacking file extension associations. Malware can use this technique to trick the user into executing unknown file types or using unknown programs to execute files.

Modifying files with the .bat extension

Prevents contained processes from changing files with the .bat extension. Use this rule to help stop malware from infecting script files on the operating system.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Modifying files with the .vbs extension

Prevents contained processes from changing files with the .vbs extension. Use this rule to help stop malware from infecting script files on the operating system.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Modifying Image File Execution Options registry entries

Prevents contained processes from changing Image File Execution Options in the registry. Malware can use this technique to hijack process execution and stop processes from executing altogether.

Modifying portable executable files

Prevents contained processes from changing any portable executable (PE) file on the system. PE files are files that Windows can execute natively, such as .exe, .dll, and .sys.

Modifying screen saver settings

Prevents contained processes from changing screensaver settings. Malware can use this technique to drop malicious payloads onto the system.

Modifying startup registry locations

Prevents contained processes from creating or changing the Windows registry startup locations. Malware frequently hides payloads or proxies to payloads in the Windows registry startup locations.

Modifying the automatic debugger

Prevents contained processes from changing or adding the automatic debugger, which malware can use to hijack process execution and steal sensitive information.

Modifying the hidden attribute bit

Prevents contained processes from changing the hidden bit in files on the system.

Modifying the read-only attribute bit

Prevents contained processes from changing the read-only bit in files on the system.

Modifying the Services registry location

Prevents contained processes from changing service behavior on the system.

Modifying the Windows Firewall policy

Prevents contained processes from changing the Windows Firewall policies stored in the registry. Malware can use the Windows Firewall to open security holes on the system.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Modifying the Windows Tasks folder

Prevents contained processes from creating or changing tasks stored in the Tasks folders. Malware can use tasks to place its payload on the system.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Modifying user policies

Prevents contained processes from changing group policy settings directly. Malware can use this technique to change the security posture and open vulnerabilities in the system.

Reading files commonly targeted by ransomware-class malware

Prevents contained processes from reading files that ransomware-class malware commonly targets. Ransomware sometimes tries to read the files into memory, write the file contents to a new file, encrypt it, and then delete the original. Ransomware-class malware does not typically try to directly change the files it is targeting for encryption. Instead, it uses a process already on the system, such as explorer.exe or powershell.exe, to proxy the attack. If enough attempts are blocked, the malware might fall back to trying to encrypt the file directly.

Reading from another process's memory

Prevents contained processes from reading the memory from another process on the system. This rule can help thwart attempts to steal information contained in targeted processes.

Reading or modifying files on any network location

Prevents contained processes from reading or changing files on network locations. Malware can use these locations to spread the infected files.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Reading or modifying files on CD, floppy, and removable drives

Prevents contained processes from reading or changing the contents of removable devices.

Malware can use these devices to propagate.

Best practice: During an outbreak, set this rule to block and report to help stop or slow the infection.

Suspending a process

Prevents contained processes from suspending other processes on the system. Some malware tries to suspend a process to hijack it or hollow it out for malicious purposes, also known as process hollowing.

Terminating another process

Prevents contained processes from stopping processes on the system.

Writing to another process's memory

Prevents contained processes from writing to the memory space of another process on the system.

Writing to files commonly targeted by ransomware-class malware

Prevents contained processes from changing files that ransomware-class malware commonly targets. Ransomware sometimes tries to read the files into memory, write the file contents to a new file, encrypt it, and then delete the original. Ransomware-class malware does not typically try to directly change the files it is targeting for encryption. Instead, it uses a process already on the system, such as explorer.exe or powershell.exe, to proxy the attack. If enough attempts are blocked, the malware might fall back to trying to encrypt the file directly.