Solved

IEnv in hips firewall

Posted on 2016-08-18
2
14 Views
Last Modified: 2016-09-07
Hi

Can anyone help me with this issue i have.

I need to add SCEP rules into McAfee HIPs manually and i have a set a rule like the following below;
%SystemRoot%\system32\raserver.exe
Can i add this to the HIPs rule as it stands or do i need to change it to the below

[IEnv SystemRoot]\system32\raserver.exe

Thanks inadvance

Spooky
0
Comment
Question by:ciscocharlie
  • 2
2 Comments
 
LVL 61

Accepted Solution

by:
btan earned 500 total points (awarded by participants)
Comment Utility
If you reference this based on HIPS 7, it is using IEnv
https://kc.mcafee.com/corporate/index?page=content&id=KB68467&pmv=print

In the forum, it is shared for [iEnv SystemRoot] and [iEnv SystemDrive] can be used interchangeably (as per guide on HIP 8) for %systemroot% and %systemdrive% respectively. However, nothing mentioned for %appdata%, %temp%, etc. Not sure if there is a equivalent field syntax. It is best to put up to McAfee support for advice instead.
https://community.mcafee.com/thread/64555?tstart=0

Most of the time, for HIP version interoperability, the executable path\name is still preferred and used for environmental related fields (on %% instead of IEnv) like
•System Environmental Variables such as %SystemRoot% can be used in exclusions. User Environmental Variables such as %UserProfile% cannot because the On‑Access scanner runs under the Windows Local System account.
https://kc.mcafee.com/corporate/index?page=content&id=KB54812

Other info

If you are looking at controlling application, you can tap on
•Host IPS Signature 6010 - Generic Application Hooking Protection
•Host IPS Signature 6011 - Generic Application Invocation Protection
https://kc.mcafee.com/corporate/index?page=content&id=KB71794

As a whole, I find the below article useful as it demonstrated with example on the examples controlling over the running executable, registry, services etc (they are using full path instead)
http://pwndizzle.blogspot.sg/2014/03/custom-mcafee-hips-rules-that-actually.html
0
 
LVL 61

Expert Comment

by:btan
Comment Utility
The switch and option in the rule are explained
0

Featured Post

Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

Join & Write a Comment

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now