Use these guidelines when specifying the OBJECT_NAME match value in a Match_type value. You can use any combination of wildcards.
Exploit Prevention is not supported in the ARM architecture.
OBJECT_NAME value | Notes |
|---|
Disk name | Accepted formats are: |
Fully qualified file path | AAC doesn't support short paths.
System — Specifies the system process name. To match based on the thread running in the system process context, the rule must set an Initiator command to "System". System:Remote — Specifies the system process name for remote systems. To match file operations for a remote system, the rule must set an Initiator command to "System:Remote".
To match based on both “System” and “System:Remote”, configure the rule to specify 2 matches or specify “System*”. |
Fully qualified registry key/value path | These root keys are recognized: Key | Matches | HKLM | HKLM is equivalent to HKEY_LOCAL_MACHINE. | HKCU | All user registry keys (not just the current user) and the .default user key. HKCU is equivalent to: HKEY_CURRENT_USER HKEY_USERS
Matching against specific user SIDs is not supported.
| HKCUC | All user classes (HKCU/*_CLASSES). | HKCR | System classes and all user classes (HKCU/*_CLASSES). HKCR is equivalent to HKEY_CLASSES_ROOT. | HKCCS | | HKLMS | | HKCUS | | HKULM | | HKULMS | | HKALL | |
If the rule specifies a name where the root starts or contains a wild character, the AAC code performs no name normalization and that name might never match correctly. For example, **\mcshield\start is a valid name, but H*L*\mcshield\start is not.
HKEY_CURRENT_CONFIG is not supported. |
Fully qualified section name | |
Process name or fully qualified process path | Process name must also be specified for thread objects. |
Volume name | Must be specified in the format: Volume{35FC9B67-54AC-49ff-AB99-33FFA2999670}
$(SystemDrive) — Immutable and always applies to the system volume.
|