Enable endpoint monitoring for file exfiltration detection

Pattern matching considerations

• You must manually deploy the YARA rule file to each device you want to monitor for patterns.
• Unlike the other types of endpoint monitoring, pattern matching only monitors files included in the user's backup file selection.
• The frequency of pattern matching scans is set by the Backup new version frequency setting. By default, this is every 15 minutes.
• Pattern matching only monitors files that are created or modified after a YARA rule is added. Files existing before a YARA rule is added are not scanned for that rule until the file changes.
• Pattern matching can scan for MD5 hash and filename matches on any file, but does not extract file contents of binary or compressed files. Practically speaking, this means pattern matching only searches the contents of plain text files, unless you create a rule targeting a specific binary string.
• After adding a new YARA rule, you must restart the Code42 service on each device.

Sample YARA rule file

The example rule file below includes two rules. Each rule contains instructions for identifying a pattern of data on users' devices, including:

• An MD5 hash for a specific file
• Text strings formatted as Social Security numbers

import "hash"

rule md5Match
{
meta:
meta_tag = "MD5 example"

condition:
hash.md5(0, filesize) == "5b110441c6eead0d1943211d6a3e704c"
}

rule ssnMatch
{
meta:
meta_tag = "SSN example"

strings:
$re1 = /(\d{3})-(\d{2})-(\d{4})/

condition:
$re1
}

View existing exclusions

Use the GET method to view existing exclusions. The OrgSettings resource also contains keys for numerous other Code42 settings. Therefore, to view only the monitoring exclusions, you must include the org_securityTools_detection_monitoring_exclusions key as a query parameter.

The example below assumes basic familiarity with curl commands. Use this as a template to create a command specific to your Code42 environment:

curl -X GET \
  '<server_address>:<port>/api/OrgSettings/<OrgID>?keys=org_securityTools_detection_monitoring_exclusions' \
  -H 'cache-control: no-cache' \
  -H 'content-type: application/json' \
  -u 'username'

1. Replace <server_address>:port> with the address of your Code42 environment. For example, https://authority-server.example.com:4285. Do not include the brackets in your request.
2. Replace <OrgID> with the numeric ID of the organization you want to update (do not include the brackets in your request). To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.
3. Replace username with your Code42 username.
4. Execute the curl command in your command-line tool of choice. When prompted, enter your password.
   The Code42 API returns the existing exclusions. If no exclusions exist yet, the data object in the response is empty.

Update or add exclusions

1. Call the Code42 API with the following curl command:

curl -i -X PUT -H 'Content-Type: application/json' -d '{"packets":[{"key":"org_securityTools_detection_monitoring_exclusions","value":"{\"windows\":[\"<regEx1>\",\"<regEx2>\"],\"macintosh\":[\"<regEx>\",\"<regEx2>\"]}","locked":true}]}' -u '<username>' https://<server address>:<port>/api/OrgSettings/<orgId>

Setting the "locked" value to "true" locks this setting so that it cannot be overridden at the user level. If you do not want to use this setting for certain users, you may move the users to a separate child organization with its own setting.

Replace the following entries with the values of your authority server:

• Replace <regEx1> and <regEx2> with regular expressions for the paths to exclude. You may add as many expressions as you need to exclude multiple paths. Make sure to include any existing values identified above that you want to continue to exclude.
  • Note: File paths must use forward slashes ( / ) for path separators, even for Windows paths. For example: [\"C:/Users/Clyde/Temp(?:.*)*\"]. Using a backslash ( \ ) to escape characters in your regex value is not supported.
• Replace <username> and <password> with the administrator username and password.
• Replace <server_address>:<port> with the host and port of your authority server.
• Replace <orgId> with the organization ID. To find this ID, export a CSV file containing the organization's data and locate the orgId value in the exported file.

2. To verify that exclusions are set, use the following curl command:

curl -i -X GET -u '<username>' https://<server_address>:<port>/api/OrgSettings/<OrgID>?keys=org_securityTools_detection_monitoring_exclusions

When prompted, enter your password. 

3. Verify the output values are set to the desired paths to exclude from monitoring.