cancel
Showing results for 
Search instead for 
Did you mean: 
lowrider1064
Level 7

HIPS Custom Signature for File access

I have luckily drawn the short straw and have been handed a project to protect some data.  I am trying to implement this through HIPS.  I need to be able to read all of the data from this special folder, block writes, and block the data from being copied from this special folder to all locations except local drives. There are two exceptions two this rule.  They should be able to write to two subfolders within the special folder and local drives.  I can get the rule to trigger in the HIPS console just fine.  Now I am working on the exceptions.  Where would I put in the exceptions for all local drives and "SpecialFolder1" and "SpecialFolder2" to allow them to write these files to those locations.

Respectfully,

Chris Priester

Update:

I got the two folders excluded, but still cannot manage to exclude local hard drives.

i have tried:

files {exclude "C:\\**"}

and

drive_types {exclude "HardDrive"}

Any suggestions would be greatly appreciated!

0 Kudos
1 Reply
greatscott
Level 12

Re: HIPS Custom Signature for File access

You aren't able to do a few of the things you are talking about. First, you are not going to be able to "read" all data from your folder, via HIPS. Second, you cannot block copies to selected drives. For the purposes of HIPS Custom Signatures, you are basically limited to directives of execute, write, create, etc.

0 Kudos