Follow these guidelines when adding files and folders, applications (processes), and MD5 hashes to the Exploit Guard exclusion list:
There are three possible values that you can exclude from Exploit Guard processing: excludedFile, excludedPaths, and excludedMD5.
Exclusion Value
Description
excludedFile
This value excludes specific files or folders from Exploit Guard alerting and action. Exploit Guard still monitors listed files. File and folder exclusions apply to file write events only.
excludedPaths
This value completely excludes the name of the binary file (.exe) from Exploit Guard monitoring. List the executable file associated with monitored application you want to exclude from Exploit Guard processing only. File paths should not be included in the excludedPaths list.
Important
The excludedPaths is the only value that will completely exclude a specific process.
Note
excludedPaths controls what is displayed in Monitored Applications.
excludedMD5
This value excludes MD5 hashes from Exploit Guard processing. MD5 hashes should be listed as a sequence of 32 hexadecimal digits. Exploit Guard will continue to monitor and detect malicious MD5 hashes but you will not receive alerts when the xAgent detects malicious actions.
Important
The Endpoint Security (HX) server does not validate the MD5 hash entries included in your Exploit Guard exclusion list. You must confirm your MD5 hash exclusions are represented by 32 hexadecimal digits.
Environment variables are not supported.
Wildcard characters are not supported.
The following table lists examples for excluding files and folders from Exploit Guard processing. Reference these examples when adding your file and folders exclusion list.
Exclusion Method | Exclusion Example |
|---|---|
Exclude a specific file name. |
|
Exclude a specific file name located in a specific directory. |
|
Exclude all files in a specific directory. |
|
Exclude all files and sub directories in a specific directory. |
|