Advanced Details

Some or all of the following parameters appear in the Advanced Details tab of events for the class Registry. The values of these parameters can help you understand why a signature is triggered.

GUI Name
explanation
Registry Key
Name of the registry key affected, including the path name. The prefix \REGIS-TRY\MACHINE\ stands for HKEY_LOCAL_MACHINE\, and \REGISTRY\CURRENT_USER\ stands for \HKEY_USER\.
Registry Value(s)
Name of the registry value concatenated with the full name of its key.
old data New Data old data type new data type
Only applicable for registry value changes: data that a registry value contained before it was changed or attempted to be changed. Only applicable for registry value changes: data that a registry value contains after it was changed or that it would contain if the change went through. Only applicable for registry value changes: type of data type that a registry value contains before it was changed or attempted to be changed Only applicable for registry value changes: type of data that a registry value would contain after it was changed or that it would contain if the change went through.

Example

The following rule would prevent anybody and any process from deleting the registry value “abc” under registry key “\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa”

Rule {

Class Registry

Id 4001

level 1

value { Include “\\REGISTRY\\MACHINE\SYSTEM\\ControlSet\\Control\\Lsa\\abc” }

time { Include “*” }

application { Include “*”}

user_name { Include “*” }

directives -c -d registry:delete

}

The various sections of this rule have the following meaning:

Copyright © 2006 McAfee, Inc. All Rights Reserved.