Different process exception on Exception Profile and Folder Allow List on Malware profile

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Different process exception on Exception Profile and Folder Allow List on Malware profile

L1 Bithead

Hi Expert,

 

Please give me advice, So I have assesment for exclusion folder and file .exe and file etc extension.

The asessment from Sophos for agent existing my customer.

 

The example exclusion files like a below :

 

C:\Windows\System32\backgroundTaskHost.exe 

C:\Program FIles (x86)\Microsoft SQL Server\

*.txt

, more again

 

So my question is, where I can add the exclusion folder/files, Malware Profile or Exception Profile?

2 REPLIES 2

L2 Linker

@Muhammad-Rusli wrote:

Hi Expert,

 

Please give me advice, So I have assesment for exclusion folder and file .exe and file etc extension.

The asessment from Sophos for agent existing my customer.

 

The example exclusion files like a below :

 

C:\Windows\System32\backgroundTaskHost.exe 

C:\Program FIles (x86)\Microsoft SQL Server\

*.txt

, more again

 

So my question is, where I can add the exclusion folder/files, Malware Profile or Exception Profile?


Hello Muhammad-Rusli,

 

It would be a best practice to first check the details of the incident and alarms within it to understand why the application was prevented, alert sources and the need for the exception. You can add more granular detail to your baseline policies configuring  an exceptions profile. (f.e  Process Exceptions, Support Exceptions, Behavioral Threat Protection Rule Exceptions, Local Analysis Rules Exceptions

L0 Member

I'm also having a difficult time looking for file extensions exclusions if that is even possible?

  • 2705 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!