ENS 10 - Creating a rule to block running a program

[Marvin]

Hi,

I have an issue with an infected process starting a system EXE and I'd like to be able to detect & block this.

I'd like to create a rule that does something like 

MyDomain\MyUser ran C:\Program Files\PROGRAM.EXE, which accessed the process C:\Windows\REGEDIT.EXE, violating the rule "XXXXXXX", and was blocked.

Can someone help me?

[AdithyanT · Accepted solution]

Hi @Marvin,

Thank you for your post.

Please Create an Access Protection rule where process/executable is the malicious/undesirable process.

Please go to sub rule and select type as "process" and add the "System" process as the target.

Ensure the action in the sub rule is selected as "execute" and the action for the rule i set to Block and Report.

I would generally recommend trying the rule with "Report" ONLY and then, once you confirm it is working, please select Block option as well.

Additionally, I sincerely hope this KBA helps as well:

https://kc.mcafee.com/corporate/index?page=content&id=KB86577

The above KBA is for situations where the target is a File or Registry, in your case, it is a process.