So I have this ASP.NET application that insists on placing its temp files directly in the Windows directory. AND it doesn't use any kind of extension. So how do you allow this without making the windows folder vulnerable?
Here is an example of the event:
TESTMODE: The process 'C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe' (as user NT AUTHORITY\NETWORK SERVICE) attempted to access 'C:\WINDOWS\2Z1J1J1Q1Q8Q8Q8X'. The attempted access was a write (operation = OPEN/CREATE). The operation would have been denied.
Wow, crazy! Okay do this:
- create a new File Access Control rule
- set to Priority Allow
- choose your application (in my case, ASP.NET)
- check Read and Write
- create new File Set
- Directories matching: @windows
- Files matching: ????????????????
- but not: *.*
Okay so here is what this does. I compared all the events, and I noticed that the random file is always exactly 16 standard characters, with no extension. The question mark (?) is a single alphanumeric wildcard. By wildcarding the exact size of the string, but not allowing anything with a period (. for an extension), I now have a file set that matches what I need to exclude.
Hope that helps someone with a similar oddity.
