Special characters in ENS Expert Rules

[ezim]

Does anybody know of a list of characters that need to be "escaped" (\ - preceded by backslash) in Trellix Endpoint Security  Expert Rules so that they are read literally in exceptions.

Like backslash itself.

Exclude OBJECT_NAME -type PATH {-v "c:\\program files\\test.dat"}

[yaz]

HI @ezim 

Thank you for reaching out to McAfee Community.

Unfortunately ENS expert rules are predefined templates that is used for customized configurations in the environment. 

The maximum options we have is defined the document below. 

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

It does not look like we have an option for Special characters. 

Was my Reply helpful?

If yes, Please give me a Kudo.

If I have answered your query, please mark this as solution so that we help other community members together. 

[ezim]

Hello @yaz 

Thank you for your response.

I am looking for a list of characters that need to have a backslash in front of it so that it is read literally, rather than interpreted as a command.

As in this example from the documentation:

Rule {
	Process {
		Include OBJECT_NAME { -v cmd.exe  }
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { 
				-v "c:\\temp\\*test.txt"
			}
   Include -access "CREATE"
		}
	}
}

Here it is necessary to use:

-v "c:\\temp\\*test.txt"

rather than:

-v "c:\temp\*test.txt"

Which other characters need to be treated in this way?

[Daveb3d · Accepted solution]

*, ?, #, {, " all come to mind.... I think $ as well.   

[bretzeli]

Samples from Mcafee (Did not know until just one hour ago myself.....)

ExpertRules/MCAFEE/PAYLOAD_EXECUTION at master · mcafee/ExpertRules · GitHub