Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

IEnv in hips firewall

Posted on 2016-08-18
2
Medium Priority
?
86 Views
Last Modified: 2016-09-07
Hi

Can anyone help me with this issue i have.

I need to add SCEP rules into McAfee HIPs manually and i have a set a rule like the following below;
%SystemRoot%\system32\raserver.exe
Can i add this to the HIPs rule as it stands or do i need to change it to the below

[IEnv SystemRoot]\system32\raserver.exe

Thanks inadvance

Spooky
0
Comment
Question by:ciscocharlie
  • 2
2 Comments
 
LVL 65

Accepted Solution

by:
btan earned 2000 total points (awarded by participants)
ID: 41762371
If you reference this based on HIPS 7, it is using IEnv
https://kc.mcafee.com/corporate/index?page=content&id=KB68467&pmv=print

In the forum, it is shared for [iEnv SystemRoot] and [iEnv SystemDrive] can be used interchangeably (as per guide on HIP 8) for %systemroot% and %systemdrive% respectively. However, nothing mentioned for %appdata%, %temp%, etc. Not sure if there is a equivalent field syntax. It is best to put up to McAfee support for advice instead.
https://community.mcafee.com/thread/64555?tstart=0

Most of the time, for HIP version interoperability, the executable path\name is still preferred and used for environmental related fields (on %% instead of IEnv) like
•System Environmental Variables such as %SystemRoot% can be used in exclusions. User Environmental Variables such as %UserProfile% cannot because the On‑Access scanner runs under the Windows Local System account.
https://kc.mcafee.com/corporate/index?page=content&id=KB54812

Other info

If you are looking at controlling application, you can tap on
•Host IPS Signature 6010 - Generic Application Hooking Protection
•Host IPS Signature 6011 - Generic Application Invocation Protection
https://kc.mcafee.com/corporate/index?page=content&id=KB71794

As a whole, I find the below article useful as it demonstrated with example on the examples controlling over the running executable, registry, services etc (they are using full path instead)
http://pwndizzle.blogspot.sg/2014/03/custom-mcafee-hips-rules-that-actually.html
0
 
LVL 65

Expert Comment

by:btan
ID: 41787477
The switch and option in the rule are explained
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

With the evolution of technology, we have finally reached a point where it is possible to have home automation features like having your thermostat turn up and door lock itself when you leave, as well as a complete home security system. This is a st…
Your business may be under attack from a silent enemy that is hard to detect. It works stealthily in the shadows to access and exploit your critical business information, sensitive confidential data and intellectual property, for commercial gain. T…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Suggested Courses

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question