Subrule page

Changing the subrule type removes any previously defined entries in the Targets table.

• Files — Protects a file or directory. For example, create a custom rule to block or report attempts to delete an Excel spreadsheet that contains sensitive information.
• Registry key (Windows only) — Protects the specified key. A registry key is the container for the registry value. For example, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
• Registry value (Windows only) — Protects the specified value. Registry values are stored in registry keys and are referenced separately from registry keys. For example, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Autorun.
• Processes — Protects the specified process. For example, create a custom rule to block or report attempted operations on a process.
• Services (Windows only) — Protects the specified service. For example, create a custom rule to prevent a service from being stopped or started.

Files:

• Change read-only or hidden attributes (Windows only) — Blocks or reports changing these attributes of files in the specified folder.
• Create — Blocks or reports creation of files in the specified folder.
• Delete — Blocks or reports deletion of files in the specified folder.
• Execute — Blocks or reports execution of files in the specified folder.
• Change permissions — Blocks or reports changing permissions settings of files in the specified folder.
• Read — Blocks or reports read access to the specified files.
• Rename — Blocks or reports rename access to the specified files.

  If the Destination file target is specified, Rename, Symlink, and Hard link are the only valid operations. See Rename operation target examples.

• Write — Blocks or reports write access to the specified files.
• Hard link (Linux only) — Blocks or reports creation of hard links.
• Symlink (Linux only) — Blocks or reports creation of symbolic links.
• Change owner (Linux only) — Blocks or reports changing ownership of a file.

Registry key: (Windows only)

• Write — Blocks or reports write access to the specified key.
• Create — Blocks or reports creation of the specified key.
• Delete — Blocks or reports deletion of the specified key.
• Read — Blocks or reports read access to the specified key.
• Enumerate — Blocks or reports enumeration of the subkeys for the specified registry key.
• Load — Blocks or reports the ability to unload the specified registry key and its subkeys from the registry.
• Replace — Blocks or reports replacement of the specified registry key and its subkeys with another file.
• Restore — Blocks or reports the ability to save registry information in a specified file and copies over the specified key.
• Change permissions — Blocks or reports changing permissions settings of specified registry key and its subkeys.

Registry value: (Windows only)

• Write — Blocks or reports write access to the specified value.
• Create — Blocks or reports creation of the specified value.
• Delete — Blocks or reports deletion of the specified value.
• Read — Blocks or reports read access to the specified value.

Processes:

• Any access (Windows only) — Blocks or reports opening the process with any access.
• Create thread (Windows only) — Blocks or reports opening the process with access to create a thread.
• Change (Windows only) — Blocks or reports opening the process with access to change.
• Terminate — Blocks or reports opening the process with access to terminate.
• Run — Blocks or reports running the specified target executable.

  You must add at least one target executable to the rule.

  For the Run operation, an event is generated when an attempt is made to run the target process. For all other operations, an event is generated when the target is opened.

• Start — Blocks or reports starting the service.
• Stop — Blocks or reports stopping the service.
• Pause — Blocks or reports pausing the service.
• Continue — Blocks or reports continuing the service after a pause.
• Create — Blocks or reports creating the service.
• Delete — Blocks or reports deleting the service.
• Enable hardware profile — Blocks or reports enabling the hardware profile of the service.
• Disable hardware profile — Blocks or reports disabling the hardware profile of the service.
• Change startup mode — Blocks or reports changing the startup mode (Boot, System, Automatic, Manual, Disabled) of the service.
• Change logon information — Blocks or reports changing the logon information of the service.

• Add — Specifies the targets for the rule. Targets vary depending on the rule type selection. You must add at least one target to the subrule.
• Delete — Deletes the selected item.
• Toggle Inclusion Status — Changes the inclusion status of the item between Include and Exclude.
• Actions —
  • Edit — Changes the selected item.
  • Duplicate — Creates a copy of the selected item.