Host Intrusion Prevention 7.0.0 for ePO 4.0 Product Guide - McAfee

Configuring Application Blocking Policies
The Application Blocking feature of Host Intrusion Prevention manages a set of applications
that you allow to run (known as application creation) or bind (known as application hooking)
with other applications.
Contents
Overview of Application Blocking policies
Working with Application Blocking policies
Working with Application Blocking Rules policies
Overview of Application Blocking policies
The Application Blocking feature monitors applications being used and allows or blocks them.
Host Intrusion Prevention offers two types of application blocking:
• Application creation
• Application hooking
When Host Intrusion Prevention monitors application creation, it looks for programs that are
trying to run. In most cases, there is no problem; but some viruses, for example, try to run
programs that harm a system. You can prevent this by creating application rules, similar to
firewall rules, which only allow programs to run that are permitted.
When Host Intrusion Prevention monitors application hooking, it looks for programs that are
trying to bind or “hook” themselves to other applications. Sometimes this behavior is harmless,
but sometimes this is suspicious behavior that can indicate a virus or other attack on your
system.
You can configure Host Intrusion Prevention to monitor only application creation, only application
hooking, or both.
With Application Blocking, create a list of application rules, one rule for each application you
want to allow or block. Each time Host Intrusion Prevention detects an application trying to
start or hook to another application, it checks its application rule list to determine whether to
allow or block the application.
Application Blocking client rules
Clients in adaptive or learn mode can create client rules to allow blocked application creation
or hooking. You can view these rules in a filtered or aggregated view to analyze them to create
create new policies or add them to existing policies.
McAfee Host Intrusion Prevention 7.0 Product Guide for use with ePolicy Orchestrator 4.0
69