1. Manuals
  2. Brands
  3. McAfee Manuals
  4. Software
  5. HISCDE-AB-IA - Host Intrusion Prevention
  6. Product manual

McAfee HISCDE-AB-IA - Host Intrusion Prevention Product Manual page 124

Product guide for use with epolicy orchestrator 4.5
Hide thumbs
Table of Contents

Advertisement

Appendix A — Writing Custom Signatures and Exceptions
Windows custom signatures
Class Buffer Overflow
Directives
bo:
stack
heap
writeable_memory
invalid_call
target_bytes
call_not_found
call_return_unreadable
call_different_target
call_return_to_api
Class Files
Directives
32-bit processes on 32-bit
Windows OS (x32)
files:
XP
create
x
read
x
write
x
execute
x
delete
x
rename
x
attribute
x
writeop
x
hardlink
x
Class Hook
Directives
hook:
set_wi n dows_hook
124
McAfee Host Intrusion Prevention 8.0 Product Guide for ePolicy Orchestrator 4.5
32-bit processes on 32-bit
Windows OS (x32)
XP
2K3
V
2K8
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
2K3
V
2K8
7
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
32-bit processes on 32-bit
Windows OS (x32)
XP
2K3
V
2K8
7
x
x
x
x
x
32-bit processes on 64-bit
Windows OS (x64)
7
XP
2K3
V
2K8
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
32-bit processes on 64-bit
Windows OS (x64)
XP
2K3
V
2K8
7
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
32-bit processes on 64-bit
Windows OS (x64)
XP
2K3
V
2K8
7
x
x
x
x
x
64-bit processes on
64-bit Windows OS
(x64)
7
XP
2K3
V
2 K 8
7
x
x
x
x
x
x
x
x
x
64-bit processes on 64-bit
Windows OS (x64)
XP
2K3
V
2K8
7
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
64-bit processes on 64-bit
Windows OS (x64)
XP
2K3
V
2K8
7
x
x
x
x
x

Advertisement

Table of Contents
loading

Related Manuals for McAfee HISCDE-AB-IA - Host Intrusion Prevention

Related Products for McAfee HISCDE-AB-IA - Host Intrusion Prevention

This manual is also suitable for:

Host intrusion prevention 8.0

Table of Contents