Security Compliance

Allow one specific .exe file to run from USB and block all others

This article explains how you can allow one specific .exe file to run from USB and block all others.

First published date

10/24/2018 8:22 PM

Last published date

10/24/2018 8:22 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
This article explains how you can allow one specific .exe to run from USB and block all others.

Product section

Security Event Manager

Resolution

A user can make use of the ready template: Detach USB - File Executed

It is searching for any FileExecute that has the providerSID = USB (for the usb defender). A user can then add one extra line to this to look for FileExecute.ExtraneousInfo Not Equal to*executableYouWantToAllowNameHere.exe*

Example:

If Calc.exe is the .exe file we want to run from the USB, but want to block all other .exe files from running:

FileExecute.ProviderSID = *USB*

AND

FileExecute.ExtraneousInfo NotEqual to *calc.exe*

This should then cause the rule to look for additional information on the file executed, if it doesn't equal executableYouWantToAllowNameHere.exe, then it will detach the USB, to stop it from running. Then if the executableYouWantToAllowNameHere.exe is running, this rule won't fire and the user can still use that one .exe file to run from the USB.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.