Whitelist specific software in Ransomware module in TMS

[ErrantOsi]

Hello,

Is it possible to whitelist specific software, such as MS Powershell as an example, in the Ransomware module in TMS?
I searched for the option in the TMS, on google and here in the live community, but haven't found anything. Is this possible?

Thanks and regards

[BPry]

@ErrantOsi,

This is either an all or nothing thing, you can't exclude just Powershell for randsomware protection. 

[briancaw · Accepted solution]

Hi @ErrantOsi

You can  actually whitelist a specific application from the Anti-Ransomware module in Traps in the Exceptions page in TMS

Once you login to the TMS console

- go to Exceptions -> Process Exceptions

- click on Actions button on the upper right area of the page and select Create Process Exceptions 

- enter the Process name,  in your example, powershell.exe

- select the Platform  Windows

- under Module, select Anti-Ransomware

- click on Create

Once created, edit the exception to add your target agents/groups you want this exception to be applied to.

Let me know if this helps.

[BPry]

@briancaw,

Never knew you could do that. Not sure why you would want to, but good to know the option exists. 

[ErrantOsi]

An Italian would say "perfetto" 🙂 Thanks!