Exploit Prevention Expert Rule Help

[tubez]

I'm trying to create an expert rule to detect when a process opens a certain file extension.

In this example, I want to detect when Excel open an IQY file.

I made a "Files" rule type, with the rule below:

Rule {
	Process {
		Include OBJECT_NAME {
			-v excel.exe  
		}
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { 
				-v "*.iqy"
			}          
			Include -access "READ"
		}
	}
}

I also tried a "Processes" rule type, with the rule below:

Rule {
	Process {
		Include OBJECT_NAME {            
			-v excel.exe
		}
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { 
				-v "*.iqy"
			}
			Include -access "EXECUTE"
		}              
	}
}

I'm sure I'm probably close, but does anyone have a suggestion on how to get this working?

[Daveb3d]

Your top rule is correct.  I verified it detects as well. 

Dave

[tubez]

Odd - I'm running ENS 10.6 and I can't get it to detect on my machine.  I can open my test IQY file all day and never see a peep in the ENS events.

Is your rule also a "files" rule type?  Can you export the rule and attach it here?

[Daveb3d]

I just copy and pasted your rule.  I did it locally though rather than in policy.  Have you verified your formatting locally?  It can be really finicky sometimes.  I know I'm stating the obvious, but make sure you have the block and report check boxes checked.  

Personally, I tend to prefer Access Protection Rules for this type of stuff, only because I don't have to write out such a long rule, but this still works for me.  

Dave

[bodysoda]

Does your ENS have updated AMCORE? Check if the AMCORE version is 0. If so then update the ENS AMCORE by clicking the UPDATE button. Just note, even EICAR file wont be detected until AMCORE gets updated.