Expert Rule - Process execution under defined conditions

[vtgt]

I am struggeling with the syntax for expert rules.

We have a requirement that a defined process "abc.exe" is only allowed to execute by a signed Powershell script.

How can we prevent the execution of process "abc.exe" by all other methods than the defined Powershell script?

Thanks a lot in advance!

[Daveb3d]

Rule {
	Process {
		Include OBJECT_NAME { -v "**" }
		Exclude AggregateMatch {
			Include OBJECT_NAME { -v "powershell.exe" }
			Include PROCESS_CMD_LINE { -v "*path\\to\\script.ps1" }
		}
	}
	Target {
		Match PROCESS {
			Include OBJECT_NAME { -v "abc.exe" }
			Include -access "CREATE"
		}
	}
}

[vtgt]

Hi @Daveb3d 

Thanks a lot for your fast reply.

Unfortunately, the rule does not work as expected.

With this configuration the defined PowerShell script is not able to start the process abc.exe.

But from a PowerShell console the execution of process abc.exe works that should not be the case.

Is some inverting of include/exclude sufficient to make it work?

[Daveb3d]

I just tested it myself.  I think the issue is just that the cmdline needs a * on both sides of it.  Try that and let me know.  If you want me to look at your exact logic with your exclusions, private message me your rule. 

Dave