Proactive Defense
131
3. Specify the file or group of files, to which you want the rule to apply
in the
Value
field.
4. Check
Including subkeys
for the rule to apply to all files
attached to the listed registry file.
Figure 39. Adding controlled registry keys
You only need to use masks with an asterisk and a question mark at the same
time as the
Include subkeys
feature if the wildcards are used in the name of the
key.
If you select a folder of registry files using a mask and specify a specific value for
it, the rule will be applied to that value for any key in the group selected.
10.1.4.2. Creating a Registry Guard rule
A Registry Guard rule specifies:
•
The program whose access to the system registry is being monitored
•
Proactive Defense’s response when a program attempts to execute an
operation with a system registry files
