Sample Expert Rule to prevent Illegal API Use

To write an expert rule to prevent illegal API use, you need to ensure that it follows the correct syntax. This rule type is built based on the legacy Trellix Host IPS.

Note

Exploit Prevention is not supported in the ARM architecture.

Here is a sample Expert rule for illegal API use rule type:

Caution

Expert Rule commands are case-sensitive.

Rule {
	time {Include "*"}
	if { $EAGENT_64Bit_Process } {
					  application {Include "[iEnv SystemRoot]\\system32\\WindowsPowerShell\\*\\powershell.exe" \
							 "[iEnv SystemRoot]\\syswow64\\WindowsPowerShell\\*\\powershell.exe" 
							 }
					} else {
						application {Include "[iEnv SystemRoot]\\system32\\WindowsPowerShell\\*\\powershell.exe" }
					}
	user_name {Include "*"}
	Vulnerability_Name {Include "Powershell Command Restriction - NoLogo"}
	directives "-d" "-c" "illegal_api_use:bad_parameter" "illegal_api_use:invalid_call"
	attributes -not_auditable 
}

To know more about Expert rules commands, see Learn Expert Rules commands for Buffer overflow, Illegal API use and Services.