Prevent notepad execution

This Expert rule prevents users from executing notepad.exe through Windows File explorer. It also considers the size of the main module memory section.

Note

Exploit Prevention is not supported in the ARM architecture.

Important

Make sure to test this Expert rule on a client system before enforcing wider.

Rule {
    Process {
        Include OBJECT_NAME {
            -v explorer.exe
        }
    }
    Target {
        Match SECTION {
            Include OBJECT_NAME {
                -v "notepad.exe"
            }
            Include OBJECT_SIZE {
                -v 12345678
            }
            Include -access "EXECUTE" ; # Prevents section execution
        }
    }
}

When you validate this rule, execute the file C:\Windows\notepad.exe. This triggers an event in Trellix Endpoint Security (ENS) Client.

For more Expert Rules examples, visit the Trellix Github repository.