Configuring Asset Management › Custom Software Signatures › Creating Custom Intellisigs › Intellisig Triggers

Intellisig Triggers

You can restrict the running of an Intellisig script to occur only when specific conditions or triggers are met. This restriction enables efficient Intellisigs to be designed. Each Intellisig need not search a file system for specific files. You can instruct the scanner to scan for specific files, registry entries, services or installed packages, and the Intellisig script runs if these conditions are met. The scanner only performs the file system search once, irrespective of the number of file criteria specified.

Note: These triggers are defined in the same way as the traditional signature definitions. Experience in creating traditional signatures using these criteria is a prerequisite.

Trigger Criteria Types

The types of triggers that can be associated with an Intellisig are as follows:

File

Supports checking for file presence, specifying criteria for search paths, filename content patterns, file creation and modification date ranges, file size ranges, MD5 hash values, and permissions.

Registry

Supports checking for registry entries on specific keys, pattern matching of values, and 32-bit and 64-bit hive checks.

Package

Checks for an installed package, specifying version, and release. On Windows, this option checks the Add/Remove programs database. On UNIX, it checks the installation database of the platform.

Service

Searches for an installed service or daemon.

Sysinfo

Supports checking attributes such as the platform, processor, OS release, OS name, and OS version.

Logical Hierarchy of Triggers

Multiple trigger criteria can be specified on an Intellisig, and the triggers can be grouped with logical AND, OR, and NOT operators. The logical operators are defined as groups with a type. The type being either and, or, or not, which defines how the results from items that are contained within the group are combined. A group (except not groups) can contain any number of additional trigger criteria, including more groups. A group of type not can only contain a single item, although this single item could be another group.

Back to Top

Excluded Directories

You can specify to exclude directories when defining an Intellisig trigger. The directories listed in the exclude directories are excluded when the signature scanner searches the file system for the files specified in file trigger criteria.

XML Format

When writing a trigger, specify criteria using XML.

Include a top-level group in each trigger. Each group contains a type. The type is either and, or, or not. The type defines the logical operation that is applied to the criteria contained in the group.

<group type=”and”>
…<other citeria>…
</group>

File Criteria

File criteria are defined with the <file> tag. The file tag supports the following attributes:

name

Specifies the file to search for

path

Specifies the path the search

match

Scans the specified file for a match of the specified pattern

md5

Compares the MD5 hash of the file with the specified value

minversion

Compares the version of the specified file with the value provided

maxversion

Compares the version of the specified file with the value provided

mincreation

Compares the file creation date of the specified file with the value provided

maxcreation

Compares the file creation date of the specified file with the value provided

minmodified

Compares the file modification date of the specified file with the value provided

maxmodified

Compares the file modification date of the specified file with the value provided

minfilesize

Compares the file size of the specified file with the size value specified

maxfilesize

Compares the file size of the specified file with the size value specified

permsmustexclude

Excludes permissions

permsmustinclude

Includes permissions

rootowner

Specifies the root owner of the file

daclallow

Allows ACL

dacldeny

Denies ACL

arch

Specifies the architecture of a binary file on the Windows platform

Example:

<group type=”and”>
<file name=”msword.exe” path=”*” />
</group>

Registry Criteria

Registry criteria are specified with the <registry> tag. The registry tag supports the following attributes:

name

Specifies the registry Key to search

match

Specifies the pattern to match against

daclallow

Allows ACL

dacldeny

Denies ACL

arch

Specifies the behavior on a 64-bit machine. Supported values are 32, or 64, and any. On a 64-bit Windows computer, specifying 64 only searches the 64-bit hive for the specified key. Specifying 32 only searches the 32-bit hive on a 64-bit computer. This value is ignored on a 32-bit computer. If the architecture is not specified, the 32 behavior is the default behavior.

Example:

<group type=”and”>
<registry name="HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\6.0\Language\UI" match="ENU" /> 
</group>

Package Criteria

Package criteria are specified with the <package> tag. The package tag supports the following attributes:

name

Specifies the name of the installed product to search for

version

Specifies the version of the installed product to search for

Example:

<group type="and">
<package name="DameWare Mini Remote Control" version="6.0.*" /> 

Service Criteria

Service criteria are specified with the <service> tag. The service tag supports the following attributes:

name

Specifies the name of the installed service to search for

path

Specifies the (UNIX only) path to the installed service

Example:

<group type="and">
<service name="SNMP"/>
</group>

SysInfo Criteria

Sysinfo criteria is specified with the <sysinfo> tag. The sysinfo tag supports the following attributes:

platform

Specifies whether the platform is x86 or x64 on Windows

processor

Identifies the processor

osrelease

Identifies the OS Release

osname

Identifies the OS Name

osversion

Identifies the OS Version

Example:

<group type=”and”>
<sysinfo osname="Windows" />
</group>

Back to Top

Trigger Parameter when an Intellisig is Launched

When a trigger is satisfied, and the Intellisig script is executed, a string is passed to the script defining the criteria that contributed to the triggering of the Intellisig. The trigger is passed to the Intellisig script using the –t flag. The format of the trigger string that is passed to the script depends on the criteria types used in the trigger definition. The following table provides examples of trigger strings with different trigger criteria types used. Where multiple triggers are contributing to the running of an Intellisig script, the individual criteria are specified with a separating | character. An Intellisig script must be able to parse the trigger string to leverage the processing that has been done in the trigger evaluation.

Back to Top