Rule syntax

Quick links: <definition> , <operations>, <description>, <actions>

A rule is a set of expressions defined using XML-based language. ESET PROTECT Web Console contains a pre-defined set of rules, but you can add and edit your own rules.

The general body structure of a rule is:

Definition Tag

ancestor—can take an additional attribute:

•distance—specifies the actual distance from the current process of the ancestor being matched, for example., 1 is the parent process, 2 grandparent, etc. If unspecified, the property is matched against all process ancestors.

•unique—enables the ancestor tag to remove duplicate processes in the ancestor tree. For example, the malware creates multiple instances of the same process to avoid detection (explorer > cmd > cmd > cmd > malware), and this attribute will get rid of these duplications (explorer > cmd > malware).

Process and parentprocess

The process part lets security engineers restrict events to a specific process; therefore, you can write rules like "Outlook creates EXE file". If the process element is empty, parentprocess and operations are evaluated for all the processes.

The parentprocess part is similar to the process but allows security engineers to test parent process attributes. This enables rules like "PowerShell, started by Word, connects to the internet".

process, parentprocess, ancestor and operation use an expression element to describe a logical expression which is evaluated to check if a detection should be triggered. An expression consists of conditions and logical operators. A condition checks the value of some property, and logical operators group these conditions into logical expressions.

Expression example:

Operations

The operations part defines which operations executed by a process raise the indicator. If empty, the indicator is triggered when the process generates an event.

Operations are defined using an operation element with a type attribute and an expression element.

<operation type="WriteFile">Expression</operation>

For the complete list of supported operations, see the Operations topic.

Operator

Supported logical operators are: AND, OR, and NOT. Logical operators can be nested. Therefore, a logical operator can be an argument of another logical operator. Apart from logical operators, a condition element can be used as an argument for logical operators. You can use the operator tag as shown in this example:

Condition elements consist of three parts:

•Property of operation's argument or process.

•A value specified by the rule's author.

•Relationship between the value and the property.

Properties are hierarchically grouped into "components".

There are three levels of severity: 1–39 > Info, 40–69 > Warning, and 70–100 > Threat.

Property types and their relations (condition attributes) are:

Description Tag

Description is mandatory and must contain a name and category, but the rest is optional. It is helpful to define the fields listed below because they appear in the details:

name—Name of the rule. It is shown in the list of rules.

category—Allows you to categorize rules. You can specify your own categories.

explanation—Explains the reason why the rule is triggered.

os—Contains the operating system to which the rule applies. Possible values are: Windows, Linux, OSX, ANY.

mitreattackid—Contains the id of the MITRE ATT&CK®.

maliciousCauses—Describes the malicious causes of the event or the change that triggered the rule.

benignCauses—Describes the benign causes of the event or the change that triggered the rule.

recommendedActions—Describes the recommended actions to be taken by security engineers.

guid—used for internal rules. External rules have guid automatically generated. It is used to uniquely identify rules during export/import.

maliciousTarget Tag

You can use the maliciousTarget tag to specify the target that will be affected by custom response actions by default. For example, when you select block executable, the changes depend on the maliciousTarget. It does not change the behavior of the Actions tag. Possible values are current, module, none and parent.

The maliciousProcess tag has been replaced by the maliciousTarget tag. It is still in legacy support but, we recommend using the maliciousTarget tag.

Actions Tag

Actions tag allows you to specify a set of actions that are executed when the rule is triggered.

You can put actions into a single action element:

<action name="BlockProcessExecutable"/>

Or stack multiple action elements into single actions element (as shown in the following example):

Multiple actions can be triggered from a single rule.

˄˅