Specifying Processes

You can specify the Process string using the same options available for Path or File.

For more details, see Specifying Paths and Processes.

If you specify both a User or Group and a Process for a rule, they work together. For example, if you choose Specific Process, a matching user or group must be running a matching process for the rule to be applied. If you choose Any Process Except, the rule is applied unless both the User or Group and the Process match the rule definition.

Table 1. Process Menu Choices

Menu Choice	Description
Any Process	Apply the rule no matter what process attempts to execute or write files matching the rule.
Any Promoted Process	Apply the rule when a process that is promoted at the time the rule is evaluated attempts an action matching the rule. A promoted process is any approved process that is generated by a file marked as an installer, or has been promoted as a consequence of a custom rule, or is an approved process launched by a promoted process.
Any System Process	Apply the rule when a process that is running under the security context of the Local System user attempts an action matching the rule. This choice has the same effect as choosing Local System in the User or Group menu, but may be more efficient.
Specific Process...	Apply the rule when a process matching a string you specify attempts an action matching the rule. You can enter one or more processes in the text box below the menu.
Any Process Except...	Apply the rule when any process except one matching a string you specify attempts an action matching the rule. You can enter one or more processes in the text box below the menu.