cancel
Showing results for 
Search instead for 
Did you mean: 
KSpann
Level 7
Report Inappropriate Content
Message 1 of 3

HIPS rules for Services not firing

I have built out numerous rules to monitor/block services from stopping and

starting to no avail.  These rules, once created, are verifed that they are

on the system via registry.  Currently I have the rule set to anything:

 

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
display_names { Include "&" }
directives services:stop services:start
}

 Nothing even shows up regarding this rule in the HipShield.log on any

system that I try this on.  I have tried all different severity levels with

no change.  My main test is with the Adobe Updater so the rule typically

looks like this:

 

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
display_names { Include "AdobeARMservice" }
directives services:stop services:start
}

 

I have also tried using 'Service' as opposed to 'Display Name' and using

"Adobe Acrobat Update Service" as well as ANY service (see below) with no

triggering.

 

Rule {
tag "Service Protection"
Class Services
Id 4149
level 4
services { Include "&" }
directives services:stop services:start
}

 

I am using HIPS 11.0.500.582 on Windows 10 managed by ePO 5.3.2.

Labels (2)
2 Replies
KSpann
Level 7
Report Inappropriate Content
Message 2 of 3

Re: HIPS rules for Services not firing

All other features of HIPS are functioning and any other rule created will fire as designed.  If we monitor the use of the executable that launches the service, that does work, however we need the Operations that are provided with a Service rule type.

Highlighted
McAfee Employee ktankink
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: HIPS rules for Services not firing

Please be aware of:

KB78600 - Service Protection Monitoring with Endpoint Security and Host Intrusion Prevention
 
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community