I inherited most of our AP rules and I find all of the rules for the main executable use the * wildcard for all executables. Then in the subrules, the file path directly to the .exe file is placed as a file type instead of a process type. I've been copying that pattern, but I don't think I'm doing it right.
If the rule is trying to block a specific .exe, should I only include it in the main 'executables' field for the rule? I would not need to create a separate subrule then, correct?
If it's a non-exe file I'm trying to block, then I would use the wildcard executable and put the file name in the subrule, correct?
For the file type, if a 'file' was specified to block executing, but it points to a .exe does it do essentially the same thing if I set the type as 'process' and blocked execution?
The rules seem to be doing the job OK. My only real concern, I guess, is if there's really any difference when trying to block a .exe file if I define it as a "file" and block execution/read/write or if I define it as a "process" and block running of it. Thanks.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.