cancel
Showing results for 
Search instead for 
Did you mean: 
KSpann
Level 7
Report Inappropriate Content
Message 1 of 3

HIPS rules for Services not firing

I have built out numerous rules to monitor/block services from stopping and

starting to no avail.  These rules, once created, are verifed that they are

on the system via registry.  Currently I have the rule set to anything:

 

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
display_names { Include "&" }
directives services:stop services:start
}

 Nothing even shows up regarding this rule in the HipShield.log on any

system that I try this on.  I have tried all different severity levels with

no change.  My main test is with the Adobe Updater so the rule typically

looks like this:

 

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
display_names { Include "AdobeARMservice" }
directives services:stop services:start
}

 

I have also tried using 'Service' as opposed to 'Display Name' and using

"Adobe Acrobat Update Service" as well as ANY service (see below) with no

triggering.

 

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
services { Include "&" }
directives services:stop services:start
}

 

I am using HIPS 11.0.500.582 on Windows 10 managed by ePO 5.3.2.

Labels (2)
2 Replies
KSpann
Level 7
Report Inappropriate Content
Message 2 of 3

Re: HIPS rules for Services not firing

All other features of HIPS are functioning and any other rule created will fire as designed.  If we monitor the use of the executable that launches the service, that does work, however we need the Operations that are provided with a Service rule type.

Highlighted
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: HIPS rules for Services not firing

Please be aware of:

KB78600 - Service Protection Monitoring with Endpoint Security and Host Intrusion Prevention
 
Member Rewards
McAfee Community rewards active and helpful members just like you. Click here to take a look at the first community members who received a special reward and were recognized by McAfee leader, Aneel Jaeel, for their participation and trusted knowledge in the community.