Access Protection - Prevent creation of folder

[therez]

Hello.  Would anyone be able to point out if it's possible to create an AP rule to prevent the creation of a folder?  I've tried various syntax's but to no avail.

Thank you.

[rfranci]

HI @therez ,

Thank you for reaching us on community.

Access Protection works based on process and files.

-Rohit Francis

[therez]

Hi Rohit

Thought as much but wanted to check, thank you for your clarification.

[ktankink · Accepted solution]

Blocking directory creation with an ENS Access Protection rule can be done.  Please refer to https://kc.mcafee.com/corporate/index?page=content&id=KB86577 for details.

Example:

• Name: Block directory creation
• Block/Report enabled
• Executable: <blank> (to apply to any source process doing the creation)
• Subrule
  • Name: <anything>
  • Subrule type: Files
  • Operation: Create
  • Targets: INCLUDE - FILE PATH - <target directory>
    • Example target: c:\temp\test1

To generate a directory:

c:\Temp>mkdir c:\temp\test1
Access is denied.

Log file:

2020-05-28 18:20:50.567Z|Activity|ApBl |mfeesp | 4140| 8668|AP |XModuleEvents.cpp(844) | TESTSYSTEM\administrator ran C:\Windows\System32\cmd.exe, which tried to access C:\temp\test1\, violating the rule "Block directory creation", and was blocked. For information about how to respond to this event, see KB85494.

Be careful with HOW you create a directory.  For example, if you're creating a directory using Windows Explorer, then you're creating a new directory name with the default "New folder" and then performing a RENAME operation to the target directory name (e.g., \test1\).  Your Access Protection rules would have to match this type of file activity; a simple 'mkdir' command doesn't do this.