Wildcards
You can use wildcards for the section values. Note the slightly different use of asterisks with
paths and addresses, which normally contain forward or backward slashes. For expert subrules
of signatures, the TCL wildcard scheme is used.
Table 22: Wildcards
What it represents
Character
A single character.
? (question mark)
Multiple characters, including / and \ .
NOTE:
For paths and addresses, use ** (two asterisks)
to include / and \; use * (one asterisk) to exclude / and
\.
* (one asterisk)
Wildcard escape.
| (pipe)
Table 23: TCL wildcards
What it represents
Character
A single character.
? (question mark)
Multiple characters, including / and \. Example:
files {
Include “C:\*.txt” ” }
* (one asterisk)
Multiple characters except / and \. Use to match the
root-level contents of a folder but not any subfolders.
Example:
files { Include “C:\test\\&.txt” }
& (ampersand)
Wildcard escape. Example:
files { Include
“C:\test\\yahoo!.txt” }
! (exclamation point)
Use of environment variables
Use environment variables, the iEnv command with one parameter (the variable name) in square
brackets [ ... ], as a shorthand to specify Windows file and directory path names.
What it represents
Environment variable
C:\winnt\, where C is the drive that contains the Windows
System folder. Example:
files {Include [iEnv
SystemRoot]\\system32\\abc.txt }
iEnv SystemRoot
C:\ where C is the drive that contains the Windows System
folder. Example:
files {Include [iEnv
SystemDrive]\\system32\\abc.txt}
iEnv SystemDrive
Use of predefined variables
Host Intrusion Prevention provides predefined variables for rule writing. These variables, are
preceded by “$,” and are listed below.
Table 24: Windows IIS Web Server
Description
Variable
Directory where inetinfo.exe is located
IIS_BinDir
Machine name that IIS runs on
IIS_Computer
Includes all files that IIS is allowed to access
IIS_Envelope
Appendix A — Writing Custom Signatures and Exceptions
Rule structure
105
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
