Options used to configure what protection policies should be applied per process. More...

Macros
#define	PROC_OPT_NONE 0x00000000
	No protection policy. The process is not protected. More...

#define	PROC_OPT_PROT_CORE_HOOKS 0x00000004
	Blocks hooks being set on core user-mode DLLs. More...

#define	PROC_OPT_PROT_UNPACK 0x00000008
	Identifies unpacking/decryption attempts in the main executable. More...

#define	PROC_OPT_PROT_WRITE_MEM 0x00000010
	Blocks foreign write inside the target process. More...

#define	PROC_OPT_PROT_WSOCK_HOOKS 0x00000020
	Blocks hooks being set on Wininet user-mode DLLs (Windows only). More...

#define	PROC_OPT_PROT_EXPLOIT 0x00000040
	Blocks malicious execution attempts. More...

#define	PROC_OPT_PROT_SET_THREAD_CTX 0x00000080
	Blocks thread hijacking attempts inside the target process (Windows only). More...

#define	PROC_OPT_PROT_PTRACE 0x00000080
	Blocks thread hijacking attempts inside the target process (Linux only). More...

#define	PROC_OPT_PROT_QUEUE_APC 0x00000100
	Blocks APC queuing inside the target process (Windows only). More...

#define	PROC_OPT_PROT_PREVENT_CHILD_CREATION 0x00000200
	Prevent the process from creating child processes (other than instances of itself). More...

#define	PROC_OPT_PROT_DOUBLE_AGENT 0x00000400
	Blocks double agent attacks (malicious DLL loading) (Windows only). More...

#define	PROC_OPT_PROT_SCAN_CMD_LINE 0x00000800
	Uses third party engines to scan the command line of a process. More...

#define	PROC_OPT_REMEDIATE 0x20000000
	Any event inside the process will trigger the injection of the remediation tool. More...

#define	PROC_OPT_KILL_ON_EXPLOIT 0x40000000

#define	PROC_OPT_BETA 0x80000000
	Process is monitored, but in log-only mode so no actions will be blocked. More...

#define	PROC_OPT_PROT_INJECTION
	Aggregates all the flags that will generate introEventInjectionViolation events. More...

#define	PROC_OPT_PROT_ALL
	Aggregates all the process protection flags. More...

Detailed Description

Options used to configure what protection policies should be applied per process.

Macro Definition Documentation

◆ PROC_OPT_BETA

#define PROC_OPT_BETA 0x80000000

Process is monitored, but in log-only mode so no actions will be blocked.

Definition at line 363 of file intro_types.h.

Referenced by IntExceptUserLogLinuxInformation(), IntLixProcPolicyIsBeta(), IntLixTaskChangeProtectionFlags(), and IntWinProcChangeProtectionFlags().

◆ PROC_OPT_KILL_ON_EXPLOIT

#define PROC_OPT_KILL_ON_EXPLOIT 0x40000000

The process will be killed if an exploit is detected.

Without this flag, if a process is protected with PROC_OPT_PROT_EXPLOIT, the instruction that generated the alert will be skipped, but the next instruction might generate a new alert and so on.

Definition at line 361 of file intro_types.h.

Referenced by IntLixTaskChangeProtectionFlags(), and IntLixVmaHandlePageExecution().

◆ PROC_OPT_NONE

#define PROC_OPT_NONE 0x00000000

No protection policy. The process is not protected.

Definition at line 331 of file intro_types.h.

◆ PROC_OPT_PROT_ALL

#define PROC_OPT_PROT_ALL

Value:

(PROC_OPT_PROT_CORE_HOOKS   |\
                                            PROC_OPT_PROT_INJECTION    |\
                                            PROC_OPT_PROT_WSOCK_HOOKS  |\
                                            PROC_OPT_PROT_EXPLOIT      |\
                                            PROC_OPT_PROT_PREVENT_CHILD_CREATION)

Aggregates all the process protection flags.

Definition at line 373 of file intro_types.h.

◆ PROC_OPT_PROT_CORE_HOOKS

#define PROC_OPT_PROT_CORE_HOOKS 0x00000004

Blocks hooks being set on core user-mode DLLs.

Definition at line 333 of file intro_types.h.

Referenced by IntLixTaskActivateProtection(), IntLixTaskAdjustProtections(), IntWinModGetProtectionOptionForModule(), IntWinModPolyHandler(), and IntWinProcChangeProtectionFlags().

◆ PROC_OPT_PROT_DOUBLE_AGENT

#define PROC_OPT_PROT_DOUBLE_AGENT 0x00000400

Blocks double agent attacks (malicious DLL loading) (Windows only).

Definition at line 351 of file intro_types.h.

Referenced by IntWinDagentHandleDoubleAgent(), and IntWinDagentSendDoubleAgentAlert().

◆ PROC_OPT_PROT_EXPLOIT

#define PROC_OPT_PROT_EXPLOIT 0x00000040

Blocks malicious execution attempts.

Definition at line 341 of file intro_types.h.

Referenced by IntLixTaskActivateExploitProtection(), IntLixTaskActivateProtection(), IntLixTaskAdjustProtections(), IntLixTaskChangeProtectionFlags(), IntLixTaskDeactivateExploitProtection(), IntLixTaskDump(), IntLixVmaAdjust(), IntLixVmaChangeProtection(), IntLixVmaExpandDownwards(), IntLixVmaHandlePageExecution(), IntLixVmaInsert(), IntLixVmaRemove(), IntWinProcChangeProtectionFlags(), IntWinThrHandleThreadHijack(), IntWinVadHandlePageExecution(), and IntWinVadIsExecSuspicious().

◆ PROC_OPT_PROT_INJECTION

#define PROC_OPT_PROT_INJECTION

Value:

(PROC_OPT_PROT_WRITE_MEM         |\
                                            PROC_OPT_PROT_SET_THREAD_CTX    |\
                                            PROC_OPT_PROT_PTRACE            |\
                                            PROC_OPT_PROT_QUEUE_APC         |\
                                            PROC_OPT_PROT_DOUBLE_AGENT)

Aggregates all the flags that will generate introEventInjectionViolation events.

Definition at line 366 of file intro_types.h.

Referenced by IntWinProcChangeProtectionFlags().

◆ PROC_OPT_PROT_PREVENT_CHILD_CREATION

#define PROC_OPT_PROT_PREVENT_CHILD_CREATION 0x00000200

Prevent the process from creating child processes (other than instances of itself).

Definition at line 349 of file intro_types.h.

Referenced by IntLixTaskHandleExec(), IntLixTaskSendBlockedEvent(), IntLixValidateProcessCreationRights(), IntWinDpiCheckCreation(), IntWinDpiHandleNormalCreationRights(), and IntWinDpiSendProcessCreationViolation().

◆ PROC_OPT_PROT_PTRACE

#define PROC_OPT_PROT_PTRACE 0x00000080

Blocks thread hijacking attempts inside the target process (Linux only).

Definition at line 345 of file intro_types.h.

Referenced by IntLixTaskChangeProtectionFlags(), and IntLixTaskHandlePtrace().

◆ PROC_OPT_PROT_QUEUE_APC

#define PROC_OPT_PROT_QUEUE_APC 0x00000100

Blocks APC queuing inside the target process (Windows only).

Definition at line 347 of file intro_types.h.

Referenced by IntWinThrHandleQueueApc().

◆ PROC_OPT_PROT_SCAN_CMD_LINE

#define PROC_OPT_PROT_SCAN_CMD_LINE 0x00000800

Uses third party engines to scan the command line of a process.

Definition at line 353 of file intro_types.h.

Referenced by IntWinGetPrcoCmdLineHandleCmdLineInMemory(), IntWinGetProcCmdLineHandleBufferInMemory(), and IntWinProcCreateProcessObject().

◆ PROC_OPT_PROT_SET_THREAD_CTX

#define PROC_OPT_PROT_SET_THREAD_CTX 0x00000080

Blocks thread hijacking attempts inside the target process (Windows only).

Definition at line 343 of file intro_types.h.

Referenced by IntWinThrHandleThreadHijack().

◆ PROC_OPT_PROT_UNPACK

#define PROC_OPT_PROT_UNPACK 0x00000008

Identifies unpacking/decryption attempts in the main executable.

Definition at line 335 of file intro_types.h.

Referenced by IntWinProcChangeProtectionFlags().

◆ PROC_OPT_PROT_WRITE_MEM

#define PROC_OPT_PROT_WRITE_MEM 0x00000010

Blocks foreign write inside the target process.

Definition at line 337 of file intro_types.h.

Referenced by IntLixAccessRemoteVmHandler(), IntLixTaskChangeProtectionFlags(), IntLixTaskHandleInjection(), IntLixTaskHandlePtrace(), IntLixTaskHandleVmRw(), IntLixTaskSendInjectionEvent(), and IntWinProcHandleCopyMemory().

◆ PROC_OPT_PROT_WSOCK_HOOKS

#define PROC_OPT_PROT_WSOCK_HOOKS 0x00000020

Blocks hooks being set on Wininet user-mode DLLs (Windows only).

Definition at line 339 of file intro_types.h.

Referenced by IntWinModGetProtectionOptionForModule(), and IntWinProcChangeProtectionFlags().

◆ PROC_OPT_REMEDIATE

#define PROC_OPT_REMEDIATE 0x20000000

Any event inside the process will trigger the injection of the remediation tool.

Definition at line 356 of file intro_types.h.

Referenced by IntLixTaskChangeProtectionFlags().

Macros