McAfee Expert Rule for PlugX

[HoangCuong]

Hi McAfee,

I expect to detect Plugx malware with the following behavior:
- Load a dll file in the same directory
- Reads a .dat file in the same directory
How can I write rules with AND conditions. I tried with the rules below, but it just seems to understand that this is an OR condition.

Rule {
    Process {
        Include OBJECT_NAME { -v *.exe }
        Exclude OBJECT_NAME {-v "C:\\Program Files\\**" }
        Exclude OBJECT_NAME {-v "C:\\Program Files (x86)\\**" }
        Exclude OBJECT_NAME {-v "C:\\Windows\\**" }
        Exclude OBJECT_NAME {-v "C:\\Windows\\Fonts\\**" }
        Exclude OBJECT_NAME {-v "C:\\Windows\\Fonts\\StaticCache.dat" }
        Exclude OBJECT_NAME {-v "C:\\ProgramData\\McAfee\\**" }
        Exclude OBJECT_NAME {-v "C:\\ProgramData\\Microsoft\\Windows Defender\\**" }
        Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\**" }
        Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\**" }
        Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Packages\\Microsoft*\\Settings\\**" }
    }
    Target {
        Match FILE {
            Include OBJECT_NAME { -v *.DAT }
            Exclude OBJECT_NAME {-v "C:\\Program Files\\**" }
            Exclude OBJECT_NAME {-v "C:\\Program Files (x86)\\**" }
            Exclude OBJECT_NAME {-v "C:\\Windows\\**" }
            Exclude OBJECT_NAME {-v "C:\\Windows\\Fonts\\**" }
            Exclude OBJECT_NAME {-v "C:\\Windows\\Fonts\\StaticCache.dat" }
            Exclude OBJECT_NAME {-v "C:\\ProgramData\\McAfee\\**" }
            Exclude OBJECT_NAME {-v "C:\\ProgramData\\Microsoft\\Windows Defender\\**" }
            Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\**" }
            Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\**" }
            Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Packages\\Microsoft*\\Settings\\**" }
            Include -access "READ_DATA"
        }
    }
    Target {
        Match FILE {
            Include OBJECT_NAME { -v *.dll }
            Exclude OBJECT_NAME {-v "C:\\Program Files\\**" }
            Exclude OBJECT_NAME {-v "C:\\Program Files (x86)\\**" }
            Exclude OBJECT_NAME {-v "C:\\Windows\\**" }
            Exclude OBJECT_NAME {-v "C:\\Windows\\Fonts\\**" }
            Exclude OBJECT_NAME {-v "C:\\Windows\\Fonts\\StaticCache.dat" }
            Exclude OBJECT_NAME {-v "C:\\ProgramData\\McAfee\\**" }
            Exclude OBJECT_NAME {-v "C:\\ProgramData\\Microsoft\\Windows Defender\\**" }
            Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\**" }
            Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\**" }
            Exclude OBJECT_NAME {-v "C:\\Users\\*\\AppData\\Local\\Packages\\Microsoft*\\Settings\\**" }
            Include -access "READ_DATA"
        }
    }
}

[AdithyanT]

Hi @HoangCuong,

Thank you or your post.

I am afraid that may not be possible at the moment using Expert rules. This may go as a product enhancement request, however, this currently works very similar to Access Protection on Endpoint Security that also does not implement "AND" conditions between rules or even among subrules and only works on "OR" basis.

How to submit a new Product Idea:

https://kc.mcafee.com/corporate/index?page=content&id=KB60021