Executables: Can be left blank, unless you want to limit the signature to specific processes that performs the file operation (for example, explorer.exe, cmd.exe).Drive type can also be used to limit the path to a specific drive type (for example, hard drive, CD, USB, network, floppy).You can't use MD5 hashes with the 'Files' parameter: path/filenameOnly.If you want to wildcard the path, begin the file name with **\ or ?:\ if you want to wildcard the drive letter (for example: **\filename.exe Or ?:\filename.exe). Operations: Create, Execute, Read, Write.Create a custom IPS signature using the FILES engine and a Subrule with the following criteria:.There are two Subrule types that can accomplish it: By using custom Host IPS signatures, you can create rules to prevent file operations (Create, Write, Execute, or Read) of malware.
