--- title: "Subrule Target page" slug: "subrule-target-page" tags: ["Reference", "ENS 10.7.x"] updated: 2026-10-06T19:45:35Z published: 2026-10-06T19:45:35Z canonical: "docs.trellix.com/subrule-target-page" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.trellix.com/llms.txt > Use this file to discover all available pages before exploring further. # Subrule Target page You can specify the inclusion status and definition for an Access Protection subrule target. Access Protection settings apply to Windows and Linux systems only. | Section | Option | Definition | | --- | --- | --- | | **Targets** | **Inclusion status** | Determines whether the target is a positive match for the subrule. Also specifies the status of the inclusion for the target. - **Include** — Indicates that the subrule can match the specified target. - **Exclude** — Indicates that the subrule must not match the specified target. Add a target with either an **Include** or **Exclude** directive. | | | *If you selected the **Files** subrule type...* | Specifies the file name, folder name, path, or drive type target for a **Files** subrule. Access Protection rules treat files and folders as case insensitive — rules apply to all case variations of the specified files and folders. For example, if you create a rule to block C:\Temp\ABC, Access Protection also blocks C:\temp\abc and C:\TEMP\Abc. - **File path** — Enter the file name, folder name, or file path. - **Destination file** — Enter the target file name or path for **Rename**, **Symlink**, or **Hard link** operations. If the **Destination file** target is selected, the **Rename**, **Symlink** (Linux only), or **Hard link** operation (Linux only) must be selected. - **Drive type** (Windows only) — Select the drive type target from the drop-down list: - **Removable** — Files on a USB drive or other removable drive connected to a USB port, including those with Windows To Go installed. This drive type doesn't include files on a CD, DVD, or floppy disk. > [!NOTE] > Note > > Blocking this drive type also blocks drives with Windows To Go installed. - **Network** — Files on a network share - **Fixed** — Files on the local hard drive or other fixed hard disk - **CD/DVD** — Files on a CD or DVD - **Floppy** — Files on a floppy disk You can use ?, *, and ** as wildcards. **System environment variables (Windows only)** System environment variables are supported. Environment variables can be specified in one of the following formats: - $(EnvVar) - $(SystemDrive), $(SystemRoot) - %EnvVar% - %SystemRoot%, %SystemDrive% Not all system-defined environment variables can be accessed using the $(var) syntax, specifically those containing the or characters. You can use the %var% syntax to avoid this issue. > [!NOTE] > Note > > User environment variables are not supported. **Files subrule target best practices (Windows only)** For example, to protect: - A file or folder named c:\testap, use a target of c:\testap or c:\testap\ - The contents of a folder, use the asterisk wildcard — c:\testap\* - The contents of a folder and its subfolders, use 2 asterisks — c:\testap\** **Files subrule target best practices (Linux only)** For example, to protect: - A file or folder named /tmp/test, use a target of /tmp/test - The contents of the folder, use the asterisk wildcard — /tmp/testdir/* - The contents of the folder and its subfolders, use 2 asterisks — /tmp/testdir/** ****Rename** operation target examples** To prevent files from being renamed, select the **Rename** operation, then set the subrule target: - To prevent any file from being renamed to newname.txt, set the **Destination file** target to "newname.txt". - To prevent original.txt from being renamed to any other name, set the **File path** target to "original.txt". - To prevent only the original.txt file from being renamed to newname.txt, specify 2 subrule targets: - Set the **File path** target to "original.txt". - Set the **Destination file** target to "newname.txt". ****Hard link** operation target examples (Linux only)** To prevent creating hard links to files, select the **Hard link** operation, the set the subrule target: - To prevent creating a hard link with the name hardlinktofile to any file, set the **Destination file** target to "hardlinktofile" - To prevent creating a hard link with any other name to the originalfile.txt file, set the **File path** target to "originalfile.txt" - To prevent only creating a hard link to the originalfile.txt file with the name hardlinktofile, specify 2 subrule targets: - Set the **File path** target to "originalfile.txt". - Set the **Destination file** target to "hardlinktofile". ****Symlink** operation target examples (Linux only)** To prevent creating symbolic links to files, select the **Symlink** operation, the set the subrule target: - To prevent creating a symbolic link with the name symlinktofile to any file, set the **Destination file** target to "symlinktofile". - To prevent creating a symbolic link with any other name to the originalfile.txt file, set the **File path** target to "originalfile.txt" - To prevent only creating a symbolic link to the originalfile.txt file with the name symlinktofile, specify 2 subrule targets: - Set the **File path** target to "originalfile.txt". - Set the **Destination file** target to "symlinktofile". ****Change owner** operation target examples (Linux only)** To prevent changing file ownership, select the **Change owner** operation, the set the subrule target. For example, to protect a file or path named /tmp/mypath, set the subrule target to "/tmp/mypath". | | | *If you selected the **Registry key** subrule type...* (Windows only) | Defines registry keys using root keys. These root keys are supported: - HKLM or HKEY_LOCAL_MACHINE - HKCU or HKEY_CURRENT_USER - HKCR or HKEY_CLASSES_ROOT - HKCCS matches HKLM/SYSTEM/CurrentControlSet and HKLM/SYSTEM/ControlSet00X - HKLMS matches HKLM/Software on 32-bit and 64-bit systems, and HKLM/Software/Wow6432Node on 64-bit systems only - HKCUS matches HKCU/Software on 32-bit and 64-bit systems, and HKCU/Software/Wow6432Node on 64-bit systems only - HKULM treated as both HKLM and HKCU - HKULMS treated as both HKLMS and HKCUS - HKALL treated as both HKLM and HKU You can use ?, *, and ** as wildcards, and \| (pipe) as an escape character. **Registry key subrule target best practices** For example, to protect: - A registry key named HKLM\SOFTWARE\testap, use a target of HKLM\SOFTWARE\testap or HKLM\SOFTWARE\testap\ - The contents of a registry key, use the asterisk wildcard — HKLM\SOFTWARE\testap\* - The contents of a registry key and its subkeys, use 2 asterisks — HKLM\SOFTWARE\testap\** - Registry keys and values under a registry key, enable the **Write** operation | | | *If you selected the **Registry value** subrule type...* (Windows only) | Defines registry values using root keys. These root keys are supported: - HKLM or HKEY_LOCAL_MACHINE - HKCU or HKEY_CURRENT_USER - HKCR or HKEY_CLASSES_ROOT - HKCCS matches HKLM/SYSTEM/CurrentControlSet and HKLM/SYSTEM/ControlSet00X - HKLMS matches HKLM/Software on 32-bit and 64-bit systems, and HKLM/Software/Wow6432Node on 64-bit systems only - HKCUS matches HKCU/Software on 32-bit and 64-bit systems, and HKCU/Software/Wow6432Node on 64-bit systems only - HKULM treated as both HKLM and HKCU - HKULMS treated as both HKLMS and HKCUS - HKALL treated as both HKLM and HKU You can use ?, *, and ** as wildcards, and \| (pipe) as an escape character. **Registry value subrule target best practices** For example, to protect: - A registry value named HKLM\SOFTWARE\testap, use a target of HKLM\SOFTWARE\testap - The registry values under a registry key, use the asterisk wildcard — HKLM\SOFTWARE\testap\* - The registry values under a registry key and its subkeys, use 2 asterisks — HKLM\SOFTWARE\testap\** | | | *If you selected the **Processes** subrule type...* | Specifies the process file name or path, MD5 hash (Windows only), or signer (Windows only) target for a **Processes** subrule. You can use ?, *, and ** as wildcards for all except MD5 hash. **Processes subrule target best practices (Windows only)** For example, to protect: - A process named c:\testap.exe, use a target file name or path of c:\testap.exe - All processes in a folder, use the asterisk wildcard — c:\testap\* - All processes in a folder and its subfolders, use 2 asterisks — c:\testap\** **Processes subrule target best practices (Linux only)** For example, to protect: - A process named /testExec, use a target file name or path of /testExec - All processes in a folder, use the asterisk wildcard — /tmp/test/* - All processes in a folder and its subfolders, use 2 asterisks — /tmp/test/** | | | *If you selected the **Services** subrule type...* (Windows only) | Specifies the service name or display name for a **Services** subrule. - **Service registered name** — Contains the name of the service in the corresponding registry key under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\. - **Service display name** — Contains the display name of the service from the DisplayName registry value under HKLM_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\\. This is the name that appears in the Services manager. For example, "Adobe Acrobat Update Service" is the display name for the "AdobeARMservice" service name. You can use ? and * as wildcards. **Services subrule target best practices** For example, to protect all Adobe services by display name, use the asterisk wildcard — Adobe* |