These examples show how to use the Reaction SCAN in the Expert Rule to trigger a process scan.
Note
Exploit Prevention is not supported in the ARM architecture.
Example 1: Expert Rule with Reaction SCAN to scan actor process
When abc.exe launches xyz.exe, the Reaction SCAN ACTOR_PROCESS scans the actor process (abc.exe).
Rule {
Reaction SCAN ACTOR_PROCESS ScanAction REPORT_CLEAN_DELETE_PROCESS
Process {
Include OBJECT_NAME { -v abc.exe}
}
Target {
Match PROCESS {
Include OBJECT_NAME { -v xyz.exe}
Include -access "CREATE"
}
}
}
Example 2: Expert Rule with Reaction SCAN to scan target process
When abc.exe launches xyz.exe, the Reaction SCAN TARGET_PROCESS scans the target process (xyz.exe).
Rule {
Reaction SCAN TARGET_PROCESS ScanAction REPORT_CLEAN_DELETE_PROCESS
Process {
Include OBJECT_NAME { -v abc.exe}
}
Target {
Match PROCESS {
Include OBJECT_NAME { -v xyz.exe}
Include -access "CREATE"
}
}
}
Example 3: Expert Rule with Reaction SCAN to scan actor process when it accesses specific registry location
When the actor process (abc.exe) accesses a registry location that starts with HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options, it triggers a process scan of abc.exe.
Rule {
Reaction SCAN ACTOR_PROCESS ScanAction REPORT_CLEAN_DELETE_PROCESS
Process {
Include OBJECT_NAME { -v abc.exe }
}
Target {
Match KEY {
Include OBJECT_NAME { -v "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options**"}
Include -access "READ"
}
}
}
Example 4: Expert Rule with Reaction SCAN to scan actor and target process
When abc.exe launches xyz.exe, the Reaction SCAN ACTOR_PROCESS scans the actor process (abc.exe) and the Reaction SCAN TARGET_PROCESS scans the target process (xyz.exe).
Rule {
Reaction SCAN ACTOR_PROCESS ScanAction REPORT_CLEAN_DELETE_PROCESS
Reaction SCAN TARGET_PROCESS ScanAction REPORT_CLEAN_DELETE_PROCESS
Process {
Include OBJECT_NAME { -v abc.exe}
}
Target {
Match PROCESS {
Include OBJECT_NAME { -v xyz.exe}
Include -access "CREATE"
}
}
}
Example 5: Chain rule (Next_Process_Behavior)
The Reaction SCAN command supports the Next_Process_Behavior chained rule ability. This Expert Rule shows that each Reaction SCAN command can have different scan actions.
Rule {
Reaction SCAN ACTOR_PROCESS ScanAction REPORT
Process {
Include OBJECT_NAME { -v abc.exe }
}
Target {
Match PROCESS {
Include OBJECT_NAME { -v xyz.exe }
Include -access "CREATE"
}
Next_Process_Behavior {
Reaction SCAN ACTOR_PROCESS ScanAction REPORT_DELETE_PROCESS
Reaction SCAN TARGET_PROCESS ScanAction REPORT_CLEAN_DELETE_PROCESS
Target {
Match PROCESS {
Include OBJECT_NAME { -v rmg.exe }
Include -access "CREATE"
}
}
}
}
}
For more Expert Rules examples, visit the Trellix Github repository.