Forensics Anti-Ransomware and Behavioral Guard Exclusions

Forensics -> Anti-Ransomware and Behavioral Guard

You can exclude these elements from the Anti-Ransomware and Behavioral Guard protection:

  • Folder - To exclude a folder or non-executable files

  • Process - To exclude an executable by element, MD5, and signer.

  • Certificate - To exclude processes based on the company that signs the certificate.

  • Protection - To exclude signature by it's name.

Notes:

  • Excluded process will be monitored but not triggered.

  • Excluded protection will not be triggered.

Syntax:

Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

Windows

Syntax:

  • You must specify the process name or full path to the process

  • Exclusion can contain environment variables

  • Wildcards are supported.

    Note - This is supported with Endpoint Security client version E86.70 and higher.

Examples:

  • Full path

    • C:\Program Files\MyTrustedDirectory\

  • Process

    • C:\Program Files\MyTrustedDirectory\ExcludeMe.exe

  • Certificate

    • Microsoft

  • md5: 0123456789012345

  • Protection: win.blocker

macOS

Syntax:

  • You must specify full path or wildcard

  • Path or file name can contain wildcards

  • Paths are case sensitive

Examples:

  • Full path or Xcode exclusion:

    :/Appliations/Xcode.app/Contents?MacOS/Xcode

  • To cover all Xcode-related executables (not only GUI app):

    /Applicatoins/Xcode.app/*

Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.