Behavioral Protections

Threat Emulation -> Anti-Exploit Exclusions

You can exclude these elements from the Anti-Exploit protection:

• Protection Name - Predefined malware signature

• Process - To exclude an executable

Currently there are five different Anti-Exploit protections available. Following is a list of the protections per-name.

Syntax for exclusions:

Excluding a protection means that files will not be monitored by Anti-Exploit.

• Process and protection

  • C:\Program Files\MyTrustedDirectory\excludeMe.exe

  • Gen.Exploiter.ROP

• Protection

  • Gen.Exploiter.ROP

Anti-Ransomware and Behavioral Guard

You can exclude these elements from the Anti-Ransomware and Behavioral Guard protection:

• Folder - To exclude a folder or non-executable files

• Process - To exclude an executable by element, MD5, and signer.

• Certificate - To exclude processes based on the company that signs the certificate.

• Protection - To exclude signature by it's name.

Syntax:

• Folder can contain environment variables

• Folder cannot contain wildcards (*)

• By default, sub-folders are included.

Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

Windows

Syntax:

Examples:

• Full path

  • C:\Program Files\MyTrustedDirectory\

• Process

  • C:\Program Files\MyTrustedDirectory\ExcludeMe.exe

• Certificate

  • Microsoft

• md5: 0123456789012345

• Protection: win.blocker

macOS

Syntax:

• You must specify full path or wildcard

• Path or file name can contain wildcards

• Paths are case sensitive

Examples:

• Full path or Xcode exclusion:

  :/Applications/Xcode.app/Contents?MacOS/Xcode

• To cover all Xcode-related executables (not only GUI app):

  /Applications/Xcode.app/*