procfilter.ini

[ProcFilter]

;
; A space-delimited list of plugins to load from the plugin directory. The
; names should not include the ".dll" extension.
;
; core - Primary functionality relating to whitelist/blacklists, logging, etc.
; antimalware - Protect a directory from accidental execution and trace execution 
; filenames - Exempt processes based on filename regex match
; users - Exempt processes based on user and group names
; performance - Enable performance capturing and metrics
; interactive - Enable interactive process creation
; sha1 - Whitelist files based on SHA1
; cmdline - Enabled "CaptureCommandLine" meta-tag in YARA rules
; remotethread - Prompts for acceptance of processes creating remote threads
; unpack - Take a post-execution memory snapshot
;
Plugins=core

;
; The local rule file to use, relative to the 'localrules\' subdirectory, or blank
; not to use local rules.
;
LocalRuleFile=master.yara

;
; Url of a git repository from which to get updates, username, password, and rule file relative
; to the 'remoterules\' subdirectory. If RemoteGitUrl or RemoteRuleFile are blank, remote rules
; will not be used.
;
; For example, to include "master.yara" inside the repo "https://github.com/godaddy/yara-rules.git"
; use the following options:
;    RemoteGitUrl=https://github.com/godaddy/yara-rules.git
;    RemoteRuleFile=master.yara
; This will clone the specified repository and include the file "master.yara" as the master rule
; file.
;
; RemoteGitUserName and RemoteGitPassword can be used to specify username and password or API key
; respectively if the target Git repository is restricted access.
;
RemoteGitUrl=
RemoteRuleFile=
RemoteGitUserName=
RemoteGitPassword=
RemotePollIntervalMinutes=60

;
; Block, Log, or Quarantine default values when the corresponding YARA meta tag is absent?
;
BlockDefault=1
LogDefault=1
QuarantineDefault=0

;
; Allow loading of plugins that aren't digitally signed?
;
AllowUnsignedPlugins=1

;
; Do periodic process scanning in background mode at a lower thread priority?
;
UseBackgroundMode=1

;
; Disable all UI prompts?
;
DisableUi=0

;
; Initiate a file/memory scan for all active processes on the system at a regular interval?
;
; 0 = Disabled
; 60 = 1 minute
; 3600 = 1 hour
; 86400 = 24 hours
PeriodicScanIntervalSeconds=0

;
; Timeout in milliseconds after scanning each process to avoid CPU spiking
;
; 0 disables sleeping between processes
;
PerProcessTimeoutMs=10

;
; Quarantine file size limit in bytes, 0 to disable size checks
;
QuarantineFileSizeLimit=0

;
; Scan file size limit in bytes, 0 to disable size checks
;
;
ScanFileSizeLimit=0

;
; Deny process creation when a scan fails?
;
DenyProcessCreationOnFailedScan=0

;
; Size of the threadpool that the ProcFilter service uses
;
;     0 = Autodetect; uses the number of cores on the machine
;  1..N = Number of threads
; -1..N = Number of threads to keep free, relative to the number of cores on the machine (an 8 core machine with a value of -3 would use 5 threads in the pool)
;
ThreadPoolSize=0

;
; Filter out messages below the specified log level for file logging
;
; 0 = Debug
; 1 = Informational
; 2 = Notice
; 3 = Warning
; 4 = Error
; 5 = Critical
; 6 = Logging Disabled
LogLevel=6

;
; Scan parameters for periodic scannning
;
ScanMemoryOnPeriodic=1
ScanFileOnPeriodic=1

;
; Scan parameters for process creation scannning
;
ScanFileOnProcessCreate=1
ScanMemoryOnProcessCreate=0

;
; Scan parameters for process termination scannning
;
ScanFileOnProcessTerminate=0
ScanMemoryOnProcessTerminate=0

;
; Scan parameters for image loading
;
ScanFileOnImageLoad=0
ScanMemoryOnImageLoad=0


[CorePlugin]

;
; Whitelist filename?
;
WhitelistFilename=whitelist.txt

;
; Blacklist filename?
;
BlacklistFilename=blacklist.txt

;
; Hash EXE files?
;
HashExes=1

;
; File size limits on quarantine/hashing?
; 0        = Unlimited
; 1048576  = 1 MB
; 2097152  = 2 MB
; 3145728  = 3 MB
; 5242880  = 5 MB
; 10485760 = 10 MB
;
MaxHashFileSize=3145728
MaxQuarantineFileSize=3145728

;
; Hash DLLs when they load?
;
HashDlls=0

;
; Rule file for command line scanning?
;
CommandLineRules=commandline.yara

;
; Rule file for filename scanning?
;
FilenameRules=filename.yara

;
; Rule file for parent filename scanning?
;
ParentFilenameRules=parentfilename.yara

;
; Log output by default without a rule match?
;
AlwaysLog=1

;
; Log command line arguments for new processes?
;
LogCommandLineArguments=1

;
; Log remote thread creation?
;
LogRemoteThreads=1


[Antimalware]

;
; If an EXE or DLL is within a directory of this name, confirmation will be required
; before it's run.
;
MalwareDirectory=malware