File Path Example Usage

Goal

Allow Rule

Block Rule

Results

Monitor all users' Downloads folder

-

  1. Enable assessment mode

  2. Any local storage

  3. String

  4. C:\Users\*\Downloads\*

Logs all attempts to access applications in all users' Downloads folder.

Monitors:

  • C:\Users\john_doe\Downloads\start.exe

  • C:\Users\Administrator\Downloads\start.exe

Block all applications located in any folder under theMyApps subfolder of either Program Files directory

-

  1. Program Files folders

  2. String

  3. \MyApps*

Blocks:

  • C:\Program Files(x86)\MyApps\start.exe

  • C:\Program Files\MyApps\start.exe

  • C:\Program Files(x86)\MyApps\bin\start.exe

Allows:

  • C:\Program Files(x86)\start.exe

Allow all applications located in any folder under theMyApps subfolder of either Program Files directory but Block all other applications/folders

  1. Program Files folders

  2. String

  3. \MyApps*

  1. Any local storage

  2. String

  3. C:\Program Files\*

AND

  1. Any local storage

  2. String

  3. C:\Program Files (x86)\*

Blocks:

  • C:\Program Files(x86)\start.exe

Allows:

  • C:\Program Files(x86)\MyApps\start.exe

  • C:\Program Files\MyApps\start.exe

  • C:\Program Files(x86)\MyApps\bin\start.exe

Block only applications located in theMyApps subfolder of either Program Files directory but Allow all other applications/folders

  1. Allow the subfolders of the MyApps directory

    1. Program Files folders

    2. String

    3. \MyApps\*\*

  1. Program Files folders

  2. String

  3. \MyApps\*

Blocks:

  • C:\Program Files(x86)\MyApps\start.exe

  • C:\Program Files\MyApps\start.exe

Allows:

  • C:\Program Files(x86)\start.exe

  • C:\Program Files(x86)\MyApps\bin\start.exe