cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
StefanT
Level 9
Report Inappropriate Content
Message 1 of 3

Wildcards in HIPS rules?

Can wildcards be used in HIPS rules?

For example, say I wanted to monitor a .ini file for write access but this file location although in the same folder resides on a different drive, when setting up the rule can I set the file path as follows:

%ProgramFiles%\Gubbins\test.ini which would then of course monitor that file regardless of which drive it was on?

Also does the wildcard %ProgramFiles% exclude both \Program Files and \Program Files (x86) simultaneously?

Thanks

Stefan

2 Replies
dyilmaz
Level 9
Report Inappropriate Content
Message 2 of 3

Re: Wildcards in HIPS rules?

Hi Stefan,

not sure if the Program Variable can be utilized like this but yes in general you can use Wildcards in Hips Rules, below some examples:

?

(question mark) A single character.

*

(asterisk) Multiple characters. user_name { Include “*” }

&

(ampersand) Multiple characters except / and \.. Use to match the root-level contents of a folder but not any subfolders. files { Include “C:\\test\\&.txt” }

!

(exclamation mark) Wildcard escape. files { Include “C:\\test\\yahoo!!.txt” }

Message was edited by: dyilmaz on 4/14/10 5:05:35 AM CDT
StefanT
Level 9
Report Inappropriate Content
Message 3 of 3

Re: Wildcards in HIPS rules?

Cool, thanks for the reply.

Stefan

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community