Rules
      Back to home
      1. Vali Cyber Knowledge Base
      2. ZeroLock®
      3. Rules

      How to Create a Program Execution Rule

      Program Execution rules allow the system administrator to restrict what programs are executed on a system.

      Once a Configuration Profile has been created, it must be applied to a ZeroLock® endpoint so the settings can take effect.  The following steps walk through the process of rule creation.

      Rule Creation

      1. To create a Program Execution rule, navigate to the Control Policies | Rules page, click the Actions drop-down menu and select Add New Rule.
        Policy Rules_Actions_Add New Rule 2.0.1

      2. On the New Policy Rule pop-up, select the drop-down menu then Program Execution.
        Policy Rule Dropdown Program Execution 2.0.1

      3. Using the variety of features offered for this Rule Type, craft a rule that fits the exact program execution control action you want ZeroLock™ to monitor.


        Each field of the Program Execution Rule is described below:
      4. Name 1

        The name of the rule as it will appear on your Rules page as well as when adding to a policy. 
        Description 2

        The description of the rule as it will appear on your Rules page as well as when adding to a policy, useful for explaining the purpose of the rule.
        Rule Type 3

        Selecting what type of rule to create (SSH-MFA, Hash, Canary, File Access, Network Access, or Program Execution). This can only be changed during initial rule creation.

        Once the rule is created, this is the only field that can no longer be edited.
        Source Type 4

        Select between Process, Executable, or Command.

        Process will trigger based on the name of the process (either child, parent process, or both, as defined in "Scope" below) that is running in memory.

        Executable will trigger based on the actual program's filename running in directories such as /bin, /sbin, and others.

        Command will trigger based on the name of the shell command used to launch and process or executable. 

        Source Process/

        Executable/

        Command

        		 5

        Designate the Regex that matches on the Process, Executable, or Command that is going to be either allowed or blocked from making a network connection.
        Operation 6

        Designate whether the rule will apply to the Process, Executable, or Command making inbound connections, outbound connections, or both.
        Block Operation 7

        Designate whether or not the source Process, Executable, or Command will be Blocked or Allowed from making a connection.

        Checking the box Blocks, while leaving it unchecked Allows the connection.
        Target Type 8 Designate whether the rule will match on connections made to/from a specified IP address or Port.
        IP/Port 9

        Multiple IP Addresses can be given a range using CIDR notation and/or using a comma-separated list (Ex. "10.0.0.0/8, 192.168.0.0/16").

        Multiple Ports can be given using a dash "-" between ranges of numbers, as well as a comma-separated list (Ex. "22, 100-200, 1000-65535").
        Scope 10 Specifies if the rule applies to the Process, Executable, or Command that is occurring as a parent process, a child of another process, or either.
        Alert Level 11 When this rule triggers, designate whether the alert that appears on the Alerts page will be a Low, Medium, or High level alert.

        Send Email Alerts

        		 12

        When this rule triggers, designate whether it will send an email alert to all Users that are assigned to the Endpoint Group of the endpoint that this rule triggered on.

        Email alerts can be configured on the System Configuration | System Settings page. 
        Response Type 13

        When this rule triggers, designate what response actions ZeroLock™ will take.

        Do Nothing will simply trigger an alert on the Alerts page where an administrator can either Release the alert or choose to manually Kill & Remediate the triggering connection.

        Suspend will lock the triggering connection but not end it immediately, waiting for an administrator to choose to Release the alert and allow the connection to continue or to Kill & Remediate it.

        Kill will automatically end the connection, but any actions taken by the connection will remain in place.

        Finally, Remediate will both end the connection and remediate any actions taken on the system by restoring the system to an unaltered state using the backup cache.

        Auto Quarantine

        		 14 When this rule triggers, designate whether the endpoint will be automatically set to Quarantine until administrator manually Unquarantines the endpoint on the Endpoints page.

      Warning:  When creating a New Policy Rule, clicking outside the border of the form will return you to the Policy Rules screen where you will have to start the process again by selecting Add New Rule from the Actions menu.

      Once the Program Execution Rule is properly configured, click the Create button at the bottom of the New Policy Rule pop-up menu.

      Add New Policy

      Before implementing a rule onto an endpoint, it must first be applied to a policy. 

      1. Navigate to the Control Policies | Policies page and select Add New Policy.
        Policies Add New Policy 2.0.1

      2. On the New Policy pop-up menu, give your new policy a name and description. To add the new program execution rule, click the Add Rules button.
        New Policy Add Rules form 2.0.1

      3. Selecting the Add Rules button brings up the available policy rules to choose from.  Once you have selected the Program Execution rule you created, click Add Selected.Policy Rule List Program Execution 2.0.1


      4. The following screen appears when Add Selected is chosen.  The final step is to select Create and a new policy is created. New Policy showing Rule Added 2.0.1-1

       

      Configuration Profile Creation

      In order to apply a policy to an endpoint, the policy must first be applied to a Configuration Profile.

      1. Navigate to the System Configuration | Config Profiles page and select the Add New Profile button.
        Program execution New Config Profile 2.0.1


      2. On the New Configuration Profile pop-up menu you can configure exactly what actions ZeroLock® will take for each protection engine. Settings can be fine-tuned for Ransomware, Cryptojacking, and Tampering protection, as well as settings for all Hash Rules set to deny based on an SHA-256 hash.
        To apply the policy that was created, navigate to the Default Control Policy drop-down menu, and select the preferred policy. Only one policy may be applied to a Configuration Profile at a time. Once complete, select the Create button at the bottom of the menu.Config Profile ProgExec_v3.0.2

      Assigning a Configuration Profile to an Endpoint

      Once a Configuration Profile has been created, it must be applied to an endpoint so the settings can take effect.

      1.  Navigate to the Endpoints page.
        Endpoint Main Page 2.0.1

      2. On the Endpoints page, select the endpoint or multiple endpoints that you want to apply the new configuration profile to. Then, click the Actions drop-down menu and select Set Endpoint Config.
        Endpoint Actions Set Endpoint Config 2.0.1

      3. On the Set Endpoint Configs pop-up menu, select the created configuration profile from the drop-down menu. Then hit the Set Configs button.


      4. Return to the Endpoints page to verify Agent endpoint(s) is properly configured with the desired profile, rules and policies.Endpoint Config Set 2.0.1
      5. You have successfully created and applied a Program Execution Rule.