Note 2
The data of the section new data must be in hexadecimal. For example, the data ‘def’ of registry
value “\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\abc” must be
represented as old_data { Include “%64%65%66”}.
Advanced details
Some or all of the following parameters appear in the Advanced Details tab of security events
for the class Registry. The values of these parameters can help you understand why a signature
is triggered.
Explanation
GUI name
Name of the registry key affected, including the path name. Note the following:
Use this syntax
For this key
Registry Key
\REGISTRY\MACHINE\
HKEY_LOCAL_MACHINE\
\REGISTRY\CURRENT_USER\
HKEY_CURRENT_USER\
\REGISTRY\MACHINE\SOFTWARE\CLASSES\
HKEY_CLASSES_ROOT\
REGISTRY\MACHINE\SYSTEM\ControlSet\HARDWARE
PROFILES\0001\
HKEY_CURRENT_CONFIG\
\REGISTRY\USER\
HKEY_USERS\
Name of the registry value concatenated with the full name of its key. Note the following:
Use this syntax
For values in this key
Registry Values
\REGISTRY\MACHINE\Test\*
HKEY_LOCAL_MACHINE\Test
\REGISTRY\CURRENT_USER\Test\*
HKEY_CURRENT_USER\Test
\REGISTRY\MACHINE\SOFTWARE\CLASSES\Test\*
HKEY_CLASSES_ROOT\Test
REGISTRY\MACHINE\SYSTEM\ControlSet\HARDWARE
PROFILES\0001\Test\*
HKEY_CURRENT_CONFIG\Test
\REGISTRY\USER\Test\*
HKEY_USERS\Test
Only applicable for registry value changes: data that a registry value contained before it was
changed or attempted to be changed.
old data
Only applicable for registry value changes: data that a registry value contains after it was
changed or that it would contain if the change went through.
new data
Only applicable for registry value changes: type of data type that a registry value contains
before it was changed or attempted to be changed.
old data type
Only applicable for registry value changes: type of data that a registry value would contain
after it was changed or that it would contain if the change went through.
new data type
The following rule would prevent anybody and any process from deleting the registry value
“abc” under registry key “\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa”
Rule {
tag "Sample8"
Class Registry
Id 4001
Appendix A — Writing Custom Signatures and Exceptions
Windows custom signatures
119
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
