HIPS rules for Services not firing

[KSpann]

I have built out numerous rules to monitor/block services from stopping and

starting to no avail.  These rules, once created, are verifed that they are

on the system via registry.  Currently I have the rule set to anything:

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
display_names { Include "&" }
directives services:stop services:start
}

 Nothing even shows up regarding this rule in the HipShield.log on any

system that I try this on.  I have tried all different severity levels with

no change.  My main test is with the Adobe Updater so the rule typically

looks like this:

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
display_names { Include "AdobeARMservice" }
directives services:stop services:start
}

I have also tried using 'Service' as opposed to 'Display Name' and using

"Adobe Acrobat Update Service" as well as ANY service (see below) with no

triggering.

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
services { Include "&" }
directives services:stop services:start
}

I am using HIPS 11.0.500.582 on Windows 10 managed by ePO 5.3.2.

[KSpann]

All other features of HIPS are functioning and any other rule created will fire as designed.  If we monitor the use of the executable that launches the service, that does work, however we need the Operations that are provided with a Service rule type.

[ktankink]

Please be aware of:

KB78600 - Service Protection Monitoring with Endpoint Security and Host Intrusion Prevention

https://kc.mcafee.com/corporate/index?page=content&id=KB78600