Behavioral Protections

Anti-Ransomware and Behavioral Guard

You can exclude these elements from the Anti-Ransomware and Behavioral Guard protection:

  • Folder - To exclude a folder or non-executable files

  • Process - To exclude an executable by element, MD5, and signer.

  • Certificate - To exclude processes based on the company that signs the certificate.

  • Protection - To exclude signature by it's name.

Note:

  • Excluded process will be monitored but not triggered.

  • Excluded protection will not be triggered.

s

Syntax:

  • Folder can contain environment variables

  • Folder cannot contain wildcards (*)

  • By default, sub-folders are included.

Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

Windows

Syntax:

Examples:

  • Full path

    • C:\Program Files\MyTrustedDirectory\

  • Process

    • C:\Program Files\MyTrustedDirectory\ExcludeMe.exe

  • Certificate

    • Microsoft

  • md5: 0123456789012345

  • Protection: win.blocker

macOS

Syntax:

  • You must specify full path or wildcard

  • Path or file name can contain wildcards

  • Paths are case sensitive

Examples:

  • Full path or Xcode exclusion:

    :/Applications/Xcode.app/Contents?MacOS/Xcode

  • To cover all Xcode-related executables (not only GUI app):

    /Applications/Xcode.app/*