The MATCH_type value determines which entries in an Include or Exclude are ORed or ANDed. Commands with the same MATCH_type value evaluate to either value (OR). Commands with different MATCH_type values evaluate to both values (AND).
Note
Exploit Prevention is not supported in the ARM architecture.
Each Match_type value uses a specific data type for its possible values. The supported data types are:
INT
x/UINTx— All match 32-bit or 64-bit numeric values.STRING — A null-terminated text string.
BITMASK — A numeric value expressed in hexadecimal notation, which is logically evaluated, such as 0xfe340ead.
BINARY — Binary data specified as a hexadecimal value, such as fe340ead.
MULTI_STRING — Sequence of null-terminated strings that are terminated by two null characters, such as "string1\0string2\0string3\0\0".
EXPANDABLE_STRING — A null-terminated string that contains unexpanded references to environment variables, such as "%PATH%".
Note
MATCH_typesvalues are case sensitive.
Match type value | Description | Data type | Valid in object types |
|---|---|---|---|
ACCESS_MASK | Specifies the access type. | UINT64 - BITMASK | All |
AUTHENTICATION_ID | Matches a textual account SDDL SID identifier. This match can be used to identify a specific user-account in policy enforcement. | STRING | All |
CACHE_ATTRIBUTE | Matches a cache attribute for the given object. Because it is a bitmask match type, any matching bits are considered a match. | BITMASK |
|
CERT_HASH | Matches the certificate hash; doesn't check whether the cert is chained to the root. If the object is of type PROCESS or THREAD, the certificate is obtained from the main entry module. This match never evaluates to true if the object is not signed. | UINT8[16] |
|
CERT_NAME | Matches the object's signing certificate name, but doesn't check whether the certificate is chained to the root. If the object is of type PROCESS or THREAD, the certificate is obtained from the main entry module. This match never evaluates to true if the object is not signed. | STRING |
|
CERT_NAME_CHAINED | Matches the object's signing certificate name, and the signing certificate must be chained to the root of the certificate store. If the object is of type PROCESS or THREAD, the certificate is obtained from the main entry module. This match never evaluates to true if the object is not signed. | STRING |
|
DESCRIPTION | Matches the “FileDescription” resource extracted from the resource section for the PE. | STRING |
|
DISKIO_HOOK | Specifies the source for the filtered disk IO, where | UINT32 | DISK |
DISK_REGION | Specifies the accessed disk region types as defined by AAC. This matching criteria aids in creating minimal rules protecting special/interesting disk areas. The defined bits are:
| UINT64 - BITMASK | DISK |
DLL_LOADED | Matches a loaded DLL in a specified PROCESS object. This is primarily useful for narrowing To match when the DLL is loaded, set the value part of the name-value bitmask to 1. To match when the DLL is not loaded, set it to 0. | BITMASK | PROCESS |
ENV_VAR | Specifies an environment variable name and its value. This criteria matches only if both name and value match the environment variables extracted from the PEB. | Named value pair: STRING, STRING |
|
EXP_USER_NAME | Selects the local account SID, when an authenticating authority isn't defined in the rule. | STRING |
|
FILE_ATIME | Matches against the file last accessed time. | INT64 |
|
FILE_ATTRIBUTES | Matches against the file attribute bits. | BITMASK |
|
FILE_CTIME | Matches against the file create time. | INT64 |
|
FILE_MTIME | Matches against the file last changed time. | INT64 |
|
FILE_PROPERTIES | Matches the bitmask against file properties reported by the
| UINT64 - BITMASK | FILE |
GROUP_NAME | Matches the provided textual name against the groups that the user token belongs to. The criteria evaluates to true if at least one matching group is found. | STRING |
|
GROUP_SID | Matches the provided textual SID (that is, S-1-5-18) against the groups that the user token belongs to. The criteria evaluates to true if at least one matching group is found. | STRING |
|
IMAGE_BASE_ADDRESS | Specifies the virtual base address for an image. This is useful for retrieving the base address for an image during an image load notification. | UINT64 | SECTION Available only during load image callbacks, access mask set to LOAD_IMAGE. |
IMAGE_ENTRY_POINT | Specifies the entry point offset (in bytes) for an image. This is useful for retrieving the entry point address for an image during an image load notification. | UINT64 | SECTION Available only during load image callbacks, access mask set to LOAD_IMAGE. |
IMAGE_PROPERTIES | Specifies different image properties, as available during an image load notification. The defined bits are:
| UINT64 - BITMASK | SECTION Available only during load image callbacks, access mask set to LOAD_IMAGE. |
IS_DIRECTORY | Matches operations against files or directories:
| UINT8 - Boolean | FILE |
IS_TRANSACTED | Matches (true) if the file is part of an NTFS TxF transaction. For PROCESS or THREAD object types, matches if the backing file object for the main executable is part of an NTFS TxF transaction. | UINT8 - Boolean |
|
KERNEL_CALLER_NAME | Matches the name of the kernel module that issued the disk IO. | STRING | DISK Valid only in the context of DeepStore. |
LBA | Compares the specified LBA (Logical Block Address) to the one that is being accessed. The location of the MBR (Master Boot Record) is always LBA 0. | UINT64 | DISK |
LBA2FILE | While filtering disk I/O, matches the specified name against the name, according to the CAPI content driver, of the file in the filtered LBA. | STRING | DISK |
LBA_FROM_END | Calculates the accessed LBA using a reverse scheme in which the last sector on the disk is considered to carry LBA 0. For example, match data that specifies range 0..1 matches access to the last 2 sectors. On a disk with N+1 blocks/sectors, where LBAN is the last block (using a 0-based scheme), match data 1..2 corresponds to access to LBAN-2 and LBAN-1. This criterion is provided for convenience, so that rules can protect several sectors, starting from an offset calculated from the end of the disk, without knowing the disk size. | UINT64 | DISK |
MD5 | Indicates the MD5 digest of the backing file. If object is of type PROCESS or THREAD, MD5 is calculated against its main executable module. | UINT8 |
|
NT_ACCESS_MASK | Matches against the native NT access mask of the I/O operation for file, registry, process, and thread access attempts. Make sure to use access masks appropriate for the object type as described in Microsoft MSDN. For example, to use NT_ACCESS_MASK to block calls to CreateFile() with GENERIC_WRITE, the bit mask must be FILE_GENERIC_WRITE.
| UINT64 - BITMASK |
|
OBJECT_NAME | Specifies the object name. Any combination of wildcards is accepted. | STRING | All |
OBJECT_SIZE | Matches against the size of the file or, for a section, the image size during load. | INT64 |
|
OPERATION_STATUS | Matches the operation status for a post-event. Not useful with non-post events. | INT32 | FILE |
OS_VERSION | Compares the specified operating system version to the actual version. The operating system version must be specified in the format:
| UINT32 | All |
PARTITION_STYLE | Compares the match criteria with the partition style of the disk | UINT32 | DISK |
PE | Matches a data value of "1" if the target file is a PE (Portable Executable, Windows executable binary) file.
| UINT8 | FILE |
PE_MD5 | Compares MD5 digest calculated across PE against the match criteria. The digest is calculated according to Microsoft Authenticode PE hash value calculations – 4-byte PE header check sum is omitted as well as the Certificate Table Entry, which is part of Optional Header Directories. | UINT8 |
|
PE_SHA1 | Compares the match data with the SHA-1 hash sum calculated across the PE. | UINT8 |
|
PE_SHA2_256 | Compares the match data with the SHA2-256 hash sum calculated across the PE. | UINT8 |
|
PE_SHA2_384 | Compares the match data with the SHA2-384 hash sum calculated across the PE. | UINT8 |
|
PE_SHA2_512 | Compares the match data with the SHA2-512 hash sum calculated across the PE. | UINT8 |
|
PROCESSOR_MODE | Matches if the match is evaluated in the context of an I/O operation originating from user-mode or kernel-mode. This is most useful for excluding processes from matching a rule if the process is executing in user-mode.
| UINT8 - KPROCESSOR_MODE (0 = kernelmode, 1 = usermode) |
|
PROCESS_CMD_LINE | Matches the process command line, extracted from the PEB (Process Environment Block), a data structure used by Microsoft Windows to hold information about running processes. | STRING |
|
PROCESS_ID/ THREAD_ID | Matches a specified thread ID.
| UINT64 - Thread ID |
|
PROCESS_STATE_BITS | Compares the specified name/bitmask with the stateID/stateBits carried by the | BITMASK |
|
PRODUCT_NAME | Matches the "ProductName" resource extracted from the resource section of the PE. | STRING |
|
REGVAL_DATA | Matches against registry value data in the context of a registry value set operation, either when a registry variable is created or its value is changed. You can use this | This data type is variable. You must specify it using the Valid data types are the same as accepted by the Windows registry:
| REGISTRY |
REMOTE_MACHINE _ADDRESS |
If used for matching, matches the specified type against file I/O initiated by a specific SMB client IP address in either IPv4 or IPv6 format. In other words, this type does not match for file I/O initiated on the local system going to an SMB server. It only matches for client I/O going to the local SMB server. This match type is mostly useful for generating event details. | STRING | This match type is valid in PROCESS |
SESSION_ID | Compares the specified match criteria against the session ID that the process/thread belongs to and can apply to both | UINT32 |
|
SHA1 | Compares the SHA-1 hash sum of the backing file with the match data. If the object is of type PROCESS or THREAD, the hash sum is calculated against its main executable module. | UINT8 |
|
SHA2_256 | Compares the SHA2-256 hash sum of the backing file with the match data. If the object is of type PROCESS or THREAD, the hash sum is calculated against its main executable module. | UINT8 |
|
SHA2_384 | Compares the SHA2-384 hash sum of the backing file with the match data. If the object is of type PROCESS or THREAD, the hash sum is calculated against its main executable module. | UINT8 |
|
SHA2_512 | Compares the SHA2-512 hash sum of the backing file with the match data. If the object is of type PROCESS or THREAD, the hash sum is calculated against its main executable module. | UINT8 |
|
STORAGE_BUS_TYPE | Compares the match criteria with the storage bus type that the disk is attached to. | UINT32 | DISK |
TARGET_OBJECT _NAME | Specifies the object name. Any combination of wildcards is accepted. Names follow the same conventions as OBJECT_NAME. But, they only match against the target of a file rename operation. This enables rules to be written that only apply to rename operations based on both source (OBJECT_NAME) and target (TARGET_OBJECT_NAME) name.
| STRING | FILE |
USER_NAME | Matches the text representation of the user name. | STRING |
|
USER_SID | Matches the text representation of the user account SID (that is, S-1-5-21-22-23-24-1168). | STRING |
|
VERSION_RESOURCE | Matches the “FileVersion” resource extracted from the resource section for the PE. | STRING |
|
VERSION | Matches the version extracted from the resource section for the file. | STRING |
|
VTP_PRIVILEGES | Matches the bitmask against the VTP privileges of the target. The defined bits are:
Files signed by Microsoft:
Files signed by Trellix:
Files signed by 3rd party:
| UINT64 - BITMASK |
|
VTP_TRUST | Checks if VTP trusts the process or file. The value is treated as Boolean. That is, a value of 1 in the match type matches only processes trusted by VTP. A value of 0 matches non-trusted processes. | UINT8 |
|
WOW64 | Matches a data value of "1" if the process/thread is a WOW64 process. This can only be true on 64-bit platforms and always matches a "0" on 32-bit platforms. This match can apply to both | UINT8 |
|