ACCESS_MASK flags

Use these flags with the ACCESS_MATCH Match_type value.

Note
Exploit Prevention is not supported in the ARM architecture.

Flag	Applies to object types	Applies when
CONNECT_NAMED_PIPE	FILE (representing a named pipe)	Attempt to connect to a named pipe.
CREATE	FILE KEY PROCESS THREAD SECTION	File, Key, Process, or Thread is created. If the Target to be blocked is a process, specify the object type as SECTION rather than PROCESS. File is open for execute (SECTION object). This doesn't mean that the SECTION object itself is created, rather that a SECTION object can be created. The SECTION object might not be created for execute.
DELETE	FILE KEY PROCESS THREAD	File or Key (not registry values) is deleted or set security is called. Process is opened with PROCESS_TERMINATE. Thread is opened with THREAD_TERMINATE.
ENUM	KEY VALUE	Key is opened with KEY_ENUMERATE_SUB_KEYS. Values are enumerated with RegEnumValue.
EXECUTE	FILE	File is opened with FILE_EXECUTE access. SECTION object is created with SECTION_MAP_EXECUTE. Tip Best practice Blocking SECTION objects might cause Windows to call a NtRaiseHardError(). To block loading unwanted code without this side-effect, use CREATE with SECTION. Directory is opened with traverse access.
LOAD_IMAGE	SECTION	Notification only (cannot block the image load).
LOAD_KEY	KEY	Registry hive is loaded into a key with ZwLoadKey or RegLoadKey.
LOCK_RANGE		Attempt to lock or unlock a byte-range lock on a file. Use this access mask to protect a log file. You don't need to use this access mask for files that you aren't going to WRITE to at runtime, but byte-range locks don't stop reading and executing files.
OPEN_FOR_DELETE	FILE	Create/open event that requested delete access.
POST	FILE	Post-operation event. Events that carry this bit only match against rules that have this bit set. Also, if the access mask contains other bits set (not including POST), the rule evaluates to true only if at least one other bit matches the event.
QUERY	KEY VALUE	Attempt to query a registry key/value occurs.
READ	FILE KEY VALUE	Existing file/key is being opened for read access. Note This does not match with registry key/value enum/query operations. See ENUM and QUERY for matching against registry query/enum operations.
READ_DATA	FILE	An actual read file I/O occurs (ReadFile executed from user-space).
RENAME	FILE KEY VALUE	Registry key or file rename operation occurs.
REPLACE_KEY	KEY	Registry key is replaced (RegReplaceKey).
RESTORE_KEY	KEY	Registry key is restored (RegRestoreKey).
SET_FILE_LENGTH	FILE	Any operation that changes the file length (ZwSetInformationFile), where class is one of: FileEndOfFileInformation FileAllocationInformation FileValidDataLengthInformation This access bit helps with file-copy detection, when the destination file is extended and then written to.
SET_REPARSE	FILE	Attempt to set the reparse data on a file or directory object. Do not use this access mask with IS_DIRECTORY. Attempts to set a reparse point on an alternate data stream don't match correctly. This is because the file system always considers alternate data streams as "file" objects, even if the base file object is a directory. But, reparse data is configurable from an alternate data stream file handle on a directory, which causes STATUS_REPARSE to be returned for all streams of a directory or file object.
TERMINATING	PROCESS THREAD	Notification only (cannot block a terminate action).
WRITE	FILE KEY VALUE PROCESS	Existing file is opened for write (FILE_GENERIC_WRITE and disposition TRUNCATE_EXISTING). File rules, using this flag, and specifying the file name as a fully qualified path including drive letter, also matches rename operations for any of the upper-level directories. For example, if the rule specifies "c:\program files\mcafee\systemcore\**", this rule matches rename operations against: c:\program files\mcafee\systemcore c:\program files\mcafee c:\program files\ But the rule doesn't match: c:\program files\microsoft c:\program files\mcafee\VSE Existing key is opened for write (KEY_WRITE). Process is opened for write access: PROCESS_CREATE_PROCESS PROCESS_CREATE_THREAD PROCESS_DUP_HANDLE PROCESS_SET_QUOTA PROCESS_SET_INFORMATION PROCESS_SUSPEND_RESUME PROCESS_VM_OPERATIONS PROCESS_VM_WRITE Handle to the thread is opened with write access: THREAD_DIRECT_IMPERSONATION THREAD_IMPERSONATE THREAD_SET_CONTEXT THREAD_SET_INFORMATION THREAD_SET_LIMITED_INFORMATION THREAD_SET_THREAD_TOKEN THREAD_SUSPEND_RESUME Registry value is created, written, or deleted. Values are considered the data of a key.
WRITE_ATTRIBUTE	FILE	File or directory's attributes are written to.
WRITE_DATA	FILE	Actual write file I/O (WriteFile executing from user-space).