mirror of
https://github.com/ComodoSecurity/openedr/
synced 2026-06-06 15:24:33 +00:00
Vasily Plotnikov
92 lines
2.1 KiB
Plaintext
92 lines
2.1 KiB
Plaintext
//
|
|
// Policy common definitions
|
|
//
|
|
{
|
|
"version": 2,
|
|
"name": "common",
|
|
|
|
"constants": {
|
|
"eventBaseType": {
|
|
"MLE_FILE_COPY": 1000001,
|
|
"MLE_PROCESS_ELEVATION": 1000002,
|
|
"MLE_THREAD_ELEVATION": 1000003,
|
|
"MLE_INTEGRITY_LEVEL_ELEVATION": 1000004,
|
|
"MLE_DANGEROUS_FILE_DOWNLOAD": 1000005,
|
|
"MLE_NETWORK_REQUEST_DATA_FROM_SHELL": 1000006,
|
|
"MLE_NETWORK_REQUEST_DATA_UNUSUAL_PORT": 1000007
|
|
},
|
|
"eventTypes": [
|
|
"LLE_PROCESS_CREATE",
|
|
"LLE_PROCESS_DELETE",
|
|
"LLE_FILE_CREATE",
|
|
"LLE_FILE_DELETE",
|
|
"LLE_FILE_CLOSE",
|
|
"LLE_FILE_DATA_CHANGE",
|
|
"LLE_FILE_DATA_READ_FULL",
|
|
"LLE_FILE_DATA_WRITE_FULL",
|
|
"LLE_REGISTRY_KEY_CREATE",
|
|
"LLE_REGISTRY_KEY_NAME_CHANGE",
|
|
"LLE_REGISTRY_KEY_DELETE",
|
|
"LLE_REGISTRY_VALUE_SET",
|
|
"LLE_REGISTRY_VALUE_DELETE",
|
|
"LLE_PROCESS_OPEN",
|
|
"LLE_PROCESS_MEMORY_READ",
|
|
"LLE_PROCESS_MEMORY_WRITE",
|
|
"LLE_WINDOW_PROC_GLOBAL_HOOK",
|
|
"LLE_KEYBOARD_GLOBAL_READ",
|
|
"LLE_DISK_RAW_WRITE_ACCESS",
|
|
"LLE_VOLUME_RAW_WRITE_ACCESS",
|
|
"LLE_DISK_LINK_CREATE",
|
|
"LLE_VOLUME_LINK_CREATE",
|
|
"LLE_DEVICE_LINK_CREATE",
|
|
"LLE_INJECTION_ACTIVITY",
|
|
"LLE_KEYBOARD_BLOCK",
|
|
"LLE_CLIPBOARD_READ",
|
|
"MLE_FILE_COPY_TO_USB",
|
|
"MLE_FILE_COPY_TO_SHARE",
|
|
"MLE_FILE_COPY_FROM_USB",
|
|
"MLE_FILE_COPY_FROM_SHARE",
|
|
"LLE_KEYBOARD_GLOBAL_WRITE",
|
|
"LLE_MICROPHONE_ENUM",
|
|
"LLE_MICROPHONE_READ",
|
|
"LLE_MOUSE_GLOBAL_WRITE",
|
|
"LLE_WINDOW_DATA_READ",
|
|
"LLE_DESKTOP_WALLPAPER_SET",
|
|
"LLE_MOUSE_BLOCK",
|
|
"LLE_NETWORK_CONNECT_IN",
|
|
"LLE_NETWORK_CONNECT_OUT",
|
|
"LLE_NETWORK_LISTEN",
|
|
"MLE_FILE_COPY",
|
|
"LLE_USER_LOGON",
|
|
"LLE_USER_IMPERSONATION",
|
|
"LLE_NETWORK_REQUEST_DNS",
|
|
"LLE_NETWORK_REQUEST_DATA",
|
|
"MLE_PROCESS_ELEVATION",
|
|
"MLE_THREAD_ELEVATION",
|
|
"MLE_INTEGRITY_LEVEL_ELEVATION",
|
|
"MLE_DANGEROUS_FILE_DOWNLOAD",
|
|
"MLE_NETWORK_REQUEST_DATA_FROM_SHELL",
|
|
"MLE_NETWORK_REQUEST_DATA_UNUSUAL_PORT"
|
|
],
|
|
"verdict": {
|
|
"ABSENT": 0,
|
|
"SAFE": 1,
|
|
"MALWARE": 2,
|
|
"UNKNOWN": 3
|
|
},
|
|
"tokenClass": {
|
|
"UNKNOWN": 0,
|
|
"GUEST": 1,
|
|
"USER": 2,
|
|
"LOCALADMIN": 3,
|
|
"DOMAINADMIN": 4,
|
|
"SERVICE": 5,
|
|
"SYSTEM": 6
|
|
},
|
|
"impersonationType": {
|
|
"LOCAL": 0,
|
|
"IPC": 1
|
|
}
|
|
}
|
|
}
|