Shmu- Remember that the applications that you mention are not sandboxed based so a different way of protecting the system is needed. With Comodo (sandbox set correctly) as well as with something like Sandboxie the rules you refer to are not needed.
By "vulnerable processes" (a term I dislike) is meant either a process that malware can be injected into and/or a valid Windows process that is commanded to run a malicious payload. Very (very, very) basically let's go over both the former and latter:
1). Process injection- Stuff like Botnets just love this method- run the malware file and it will inject (or hook) into something like svchost, which will then be co-opted to send malware to thousands of email addys. With Comodo trhere is no need to obsess over how to make some sort of rule for injected svchost since the sandbox (once again, properly set) will prevent the injection from occurring in the first place (if you want to see malware like this in action, I published an Avast vs Spambot video on Nov 5).
2). Things that are commanded to run a payload- this can range from rundll32 running a payload dll, or wscript.exe running a malicious vbs script (both really popular ransomware mechanisms)- in both of these cases although both rundll32 and wscript can be called up to run the payload, the payload itself will be in the sandbox so activating it won't effect the real system one little bit (see the Nov 12 Comodo vs Ransomware video for these examples).
Anyway, I'm sure one can think up rules for things like this, but why would one even bother to do so? When using Comodo never make things hard on yourself by over thinking things. Simplest is the best, and that has been a real hard concept to get across.
