Macfee自定义安全策略

路径： VirusScan Enterprise  > Access Protection Policies

 

Port blocking rules

 

Rule 1-1

Alerts when Powershell opens a remote HTTP session
FP Risk: Very High

Process	powershell.exe
Port	80
Direction	Outbound
Action	Report
Rule name	Powershell HTTP remote session

 

File/folder blocking rule

 

Rule 2-1

Alerts when Microsoft Word spawns a cmd session

FP Risk: Low

Process	winword.exe
File	C:\Windows\Sys*\cmd.exe
File actions	Files being executed
Action	Block, Report
Rule name	Word cmd execution

 

Rule 2-2

Alerts when Microsoft Excel spawns a cmd session

FP Risk: Medium

Process	excel.exe
File	C:\Windows\Sys*\cmd.exe
File actions	Files being executed
Action	Report
Rule name	Excel cmd execution

 

Rule 2-3

Alerts when Microsoft Word spawns a powershell session

FP Risk: Low

Process	winword.exe
File	C:\Windows\Sys*\powershell.exe
File actions	Files being executed
Action	Block, Report
Rule name	Word powershell execution

 

Rule 2-4

Alerts when Microsoft Excel spawns a powershell session

FP Risk: Medium

Process	excel.exe
File	C:\Windows\Sys*\powershell.exe
File actions	Files being executed
Action	Block, Report
Rule name	Excel powershell execution

 

Rule 2-5

Protects against recent Emotet campaigns seen in the wild

FP Risk: Low

Process	powershell.exe
File	C:\Users\Public\*.exe
File actions	New files being created, Files being executed
Action	Block, Report
Rule name	Powershell emotet launcher

 

Rule 2-6

Prevents possible Trojans from being launched from AppData

FP Risk: Low

Process	*
File	C:\Users\*\AppData\*.exe
File actions	New files being created, Files being executed
Action	Block, Report
Rule name	AppData File Execution

 

Rule 2-7

Blocks the Tor browser from being launched

FP Risk: Very Low

Process	*
File	tor.exe
File actions	New files being created, Files being executed
Action	Block, Report
Rule name	Tor process launched

 

Rule 2-8

rundll32 file executions in AppData

FP Risk: Low

Process	rundll32.exe
File	C:\Users\*\AppData\*
File actions	Files being executed
Action	Block, Report
Rule name	rundll32 AppData file execution

 

Rule 2-9

Word uses certutil to decode encrypted commands in macros 

FP Risk: Low

Process	winword.exe
File	C:\Windows\System32\certutil.exe
File actions	Files being executed
Action	Block, Report
Rule name	Word certutil execution

 

Rule 2-10

Excel uses certutil to decode encrypted commands in macros 

FP Risk: Low

Process	excel.exe
File	C:\Windows\System32\certutil.exe
File actions	Files being executed
Action	Block, Report
Rule name	Excel certutil execution

 

Rule 2-11

regsvr32 launches with sct file

FP Risk: Low

Process	regsvr32.exe
File	*.sct*
File actions	Files being executed
Action	Block, Report
Rule name	Regsvr32 sct file execution

 

Rule 2-12

mshta.exe launches with a .hta file

FP Risk: Low

Process	mshta.exe
File	*.hta*
File actions	Files being executed
Action	Block, Report
File name	hta file execution

 

Registry blocking rule

 

Rule 3-1

Monitors programs added to autostart for persistence for all users

FP Risk: Medium

Process	*
Key	HKLM/Software/Microsoft/Windows/CurrentVersion/Run
Reg actions	Create key or value
Action	Report
Rule name	HKLM Persistence

 

Rule 3-2

Monitors programs added to autostart for persistence for local user

FP Risk: Medium

Process	*
Key	HKCU/Software/Microsoft/Windows/CurrentVersion/Run
Reg actions	Create key or value
Action	Report
Rule name	HKCU Persistence