Controlling code execution
This protection type allows or prohibits the loading of executable code from executable files or DLL libraries.
The files or libraries in question are identified in rules by a path, alternate data stream, owner and/or volume type.
EXAMPLE
These rules make it possible for example to allow the execution of only binary files installed by the operating system or by administrators of the agent pool, or to prevent dangerous applications from executing certain DLL files.
An application identifier must be created beforehand for applications that are allowed or not allowed to run files or libraries. For more information, refer to the section Creating application identifiers.
- Select the Security > Policies menu and click on your policy.
- Select a rule set.
- Click on the Application > Code execution tab.
-
If you are in read-only mode, click on Edit in the upper banner.
- Click on Add a rule (Code execution). A new row appears.
- Click on in the area on the left to show the window where IDs of restricted access executable or DLL files are created.
- Enter the ID name.
- Enter a path, an extension or name of an executable or DLL file. The generic characters "?" and "*" are allowed in this field.
- Choose the type of volume on which the file or DLL is located.
- You can specify the Windows account that owns the files in advanced settings, provided that these files are located on a local volume. You can also manually enter a Security ID (SID) to indicate a personal Windows account. This option makes it possible to allow or prevent the execution of files or DLLs hosted on certain accounts.
- You can also specify an alternate data stream. A file’s alternate data stream contains metadata and makes it possible to find out the origin of the file. For example, by specifying the alternate data stream "zone.identifier", rules can be created for files originating from the Internet. The alternate data stream can also be an attack vector by harboring malicious code. The generic characters "?" and "*" are allowed in this field.
- Click on OK to close the ID creation window. Scroll over the name of the ID to see a summary of the settings.
- In the Execution field in the Default behavior area, choose what you want the protection rule to do:
- Allow to allow the action by default,
- Block to block the action by default,
- Block and kill to block the action by default, and shut down the process that launched the action.
- Block, kill and quarantine to block the action by default, kill the process that triggered the action, and quarantine suspicious files. For more information, see the section Managing file quarantine.
- Click on + Add a specific behavior and choose the resource(s) that you want to exclude from the default behavior. In the associated Execution field, choose whether code execution must be allowed or blocked. You can also choose to block it and shut down the process that launched the action.
- In the upper banner in the rule, you can:
- Make the rule passive. Passive rules behave like standard rules but do not actually block any actions. The agent only generates logs that indicate which actions security rules would have blocked.
Use this mode to test new restriction rules, find out their impact, and make the necessary adjustments before disabling Passive rule mode. For further information on testing rules and policies, refer to Testing security policies. - Indicate whether the rule must generate a context when it is applied. By default, if a rule generates Emergency or Alert logs, it will generate a context, but you can disable this feature.
- Select the log settings that this rule will send.
- Specify whether an action must be performed when a log is sent for this rule. You can choose to display a notification on the agent and/or run a script.
- Enter a description to explain what this rule aims to achieve.
- Make the rule passive. Passive rules behave like standard rules but do not actually block any actions. The agent only generates logs that indicate which actions security rules would have blocked.
- The row number of each rule appears on its left. Rearrange the sequence of your rules if you need to, by clicking on the arrows above and below the row number.
- Click on Save at the top right of the window to save changes.