--- title: "Subrule page" slug: "subrule-page" tags: ["Reference", "ENS 10.7.x"] updated: 2026-10-06T19:45:35Z published: 2026-10-06T19:45:35Z canonical: "docs.trellix.com/subrule-page" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.trellix.com/llms.txt > Use this file to discover all available pages before exploring further. # Subrule page Add or edit user-defined Access Protection subrules. Access Protection settings apply to Windows and Linux systems only. | Section | Option | Definition | | --- | --- | --- | | **Description** | **Name** | Specifies the name of the subrule. | | **Properties** | **Subrule type** | Specifies the subrule type. Changing the subrule type removes any previously defined entries in the **Targets** table. - **Files** — Protects a file or directory. For example, create a custom rule to block or report attempts to delete an Excel spreadsheet that contains sensitive information. - **Registry key** (Windows only) — Protects the specified key. A registry key is the container for the registry value. For example, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. - **Registry value** (Windows only) — Protects the specified value. Registry values are stored in registry keys and are referenced separately from registry keys. For example, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Autorun. - **Processes** — Protects the specified process. For example, create a custom rule to block or report attempted operations on a process. - **Services** (Windows only) — Protects the specified service. For example, create a custom rule to prevent a service from being stopped or started. | | **Operations** | Indicates the operations permitted with the specified subrule type. You must specify at least one operation to apply to the subrule. **Files**: - **Change read-only or hidden attributes** (Windows only) — Blocks or reports changing these attributes of files in the specified folder. - **Create** — Blocks or reports creation of files in the specified folder. - **Delete** — Blocks or reports deletion of files in the specified folder. - **Execute** — Blocks or reports execution of files in the specified folder. - **Change permissions** — Blocks or reports changing permissions settings of files in the specified folder. - **Read** — Blocks or reports read access to the specified files. - **Rename** — Blocks or reports rename access to the specified files. If the **Destination file** target is specified, **Rename**, **Symlink**, and **Hard link** are the only valid operations. See Rename operation target examples. - **Write** — Blocks or reports write access to the specified files. - **Hard link** (Linux only) — Blocks or reports creation of hard links. - **Symlink** (Linux only) — Blocks or reports creation of symbolic links. - **Change owner** (Linux only) — Blocks or reports changing ownership of a file. **Registry key**: (Windows only) - **Write** — Blocks or reports write access to the specified key. - **Create** — Blocks or reports creation of the specified key. - **Delete** — Blocks or reports deletion of the specified key. - **Read** — Blocks or reports read access to the specified key. - **Enumerate** — Blocks or reports enumeration of the subkeys for the specified registry key. - **Load** — Blocks or reports the ability to unload the specified registry key and its subkeys from the registry. - **Replace** — Blocks or reports replacement of the specified registry key and its subkeys with another file. - **Restore** — Blocks or reports the ability to save registry information in a specified file and copies over the specified key. - **Change permissions** — Blocks or reports changing permissions settings of specified registry key and its subkeys. **Registry value**: (Windows only) - **Write** — Blocks or reports write access to the specified value. - **Create** — Blocks or reports creation of the specified value. - **Delete** — Blocks or reports deletion of the specified value. - **Read** — Blocks or reports read access to the specified value. **Processes**: - **Any access** (Windows only) — Blocks or reports opening the process with any access. - **Create thread** (Windows only) — Blocks or reports opening the process with access to create a thread. - **Change** (Windows only) — Blocks or reports opening the process with access to change. - **Terminate** — Blocks or reports opening the process with access to terminate. - **Run** — Blocks or reports running the specified target executable. You must add at least one target executable to the rule. For the **Run** operation, an event is generated when an attempt is made to run the target process. For all other operations, an event is generated when the target is opened. **Services**: (Windows only) > [!NOTE] > Note > > With Microsoft Windows 8.1 and later, Access Protection rules no longer support operations for the **Services** subrule type. This is because Microsoft made services.exe a protected process in Windows 8.1 and later. - **Start** — Blocks or reports starting the service. - **Stop** — Blocks or reports stopping the service. - **Pause** — Blocks or reports pausing the service. - **Continue** — Blocks or reports continuing the service after a pause. - **Create** — Blocks or reports creating the service. - **Delete** — Blocks or reports deleting the service. - **Enable hardware profile** — Blocks or reports enabling the hardware profile of the service. - **Disable hardware profile** — Blocks or reports disabling the hardware profile of the service. - **Change startup mode** — Blocks or reports changing the startup mode (Boot, System, Automatic, Manual, Disabled) of the service. - **Change logon information** — Blocks or reports changing the logon information of the service. | | **Targets** | - **Add** — Specifies the targets for the rule. Targets vary depending on the rule type selection. You must add at least one target to the subrule. - **Delete** — Deletes the selected item. - **Toggle Inclusion Status** — Changes the inclusion status of the item between **Include** and **Exclude**. - **Actions** — - **Edit** — Changes the selected item. - **Duplicate** — Creates a copy of the selected item. |