G DATA XDR

Creating Exclusions in G DATA XDR

The risk assessment

Creating an Exclusion is always associated with risk. Each Exclusion must be carefully weighed (risk/benefit assessment). Keep in mind that excluded files, folders, and processes, depending on the type of Exclusion, are not scanned or, in the event of a Detection, are not stopped. This can lead to financial and/or privacy-related damage.

In the event of damage that could not be reliably prevented due to the disabled protection, you are responsible.

The risks of an Exclusion, if it is necessary, should be kept as low as possible.

Examples:

  • It is better to exclude files than folders.

  • If you create a process Exclusion, keep in mind that you are effectively granting an executable broad permission. Then do not additionally create a file Exclusion for the executable, so that the file is definitely scanned before it is started.

  • If possible, do not use Wildcards. While they are generally possible, they increase the risk.

  • Limit the scope of an Exclusion as much as possible so that unnecessary Exclusions are not present on the systems.

  • Limit Exclusions as often as possible by using command lines. In this case, an Exclusion applies only if you invoke it with exactly this command. This makes a difference, for example, whether a file is invoked by explorer.exe or by an unknown process.

When creating Exclusions, it is recommended to consider the associated system permissions of user groups.

What types of Exclusions are there?

The following applies to all types:

  • Wildcards are possible, but should be avoided whenever possible. Otherwise, for example, someone could place a virus with the same file name in a different folder and start it. It would not be scanned.
    Create Exclusions only after an Alert has been created or a file has been moved to quarantine due to a False positive Detection. This avoids typing paths. In both cases, you will find Exclusion functions on the relevant portal page. This allows you to set the Detection as an Exclusion with just a few clicks.

  • All Exclusions must be created with the full path.

There are 3 types of Exclusions:

  • File
    Files with exactly this file name are handled according to the configured mode.

  • Process
    The executable is scanned when it is started; all activities and operations performed by the process are then handled according to the configured mode.
    If you select this type, you have the option to define restrictions. An optional field for entering a command line is provided in the input form. To restrict the process Exclusion to a specific command, simply enter the command in this field.

  • Registry
    An accessed registry key is handled according to the configured mode.

Which mode can I specify for the Exclusion?

Each Exclusion must be assigned a mode.

When you enter the Exclusion, depending on the selected type, the selection menu provides the appropriate mode selection.

The modes:

Do not stop process / Do not move file to quarantine / Do not delete registry key

This mode is a logging-only mode. Excluded files/directories/processes/registry keys are scanned and an Alert is created in the event of a Detection, but

  • a reported process is not stopped.

  • a file or directory is not moved to quarantine.

  • a registry key is not deleted.

This mode is intended to prevent critical processes or important files from being stopped or moved due to a False positive Detection, which could cause major issues on the systems. Please note that this also means that valuable time is lost in the event of a virus infection. Events are reported, but the process continues to run and could already cause damage before you are able to respond to the Alert. Therefore, use this mode only for truly known, trustworthy processes that you have obtained from a trustworthy source and whose failure could cause truly critical issues on your systems, disrupt your workflows in the long term, or for which restoring from quarantine would require a disproportionate amount of time (for example, with an on-premises Exchange).

Do Not Scan

Exclusions in this mode result in a file or process not being scanned at all and therefore no Alert can be created.
Whenever possible, this mode should not be selected at all or only in special exceptional cases, as it carries by far the highest risk. It should be used only in cases of significant performance issues.
Especially on very fast hardware, it can sometimes happen that software reacts sensitively to even minimal delays in an activity. For example, with backup programs: due to the large volume of file handling operations performed in very rapid succession, even a fraction of a second of delay can cause the backup program to stumble and ultimately cause the backup to fail. In such cases, the Do Not Scan mode may be acceptable.

Do Not Create Alert

In this mode, the file/process/registry key specified in the Exclusion continues to be scanned. However, after the scan, no action is taken. In contrast to the Do not stop process / Do not move file to quarantine / Do not delete registry key mode, here not only the process is not stopped or the file is not moved to quarantine—no Alert is created either.
This mode prevents Alerts and quarantine actions from repeatedly occurring due to False positive Detections until the Detection is resolved. Ideally, this mode should be created in combination with a restriction.
This works most easily via the Exclusion functions in the Alerts and Quarantine areas.

The scope of Exclusions

You can create Exclusions for individual Endpoints or for all Endpoints in an organizational unit (OU).

Note that Exclusions that you create for an organizational unit (OU) are inherited by the subordinate organizational units.

For example, your organizational units are structured as follows:

MyCompany
└ Default
  └ IT
  └ Accounting
  └ Server

If you now want to set an Exclusion for IT and you enter it at the Default level instead, the Exclusion applies to all 3 organizational units: IT, Accounting, and Server.

The syntax of Wildcards

File and process Exclusions

Examples:

Character Example Result

Asterisk

*

Everything is excluded

C:\*\ausnahme.exe

  • C:\xxx\ausnahme.exe

  • C:\yyy\ausnahme.exe

  • C:\xxx\yyy\ausnahme.exe

*.exe

  • C:\xxx\yyy\ausnahme.exe

  • C:\xxx\yyy\.exe

  • \\xxx\ausnahme.exe

C:\abc*

  • C:\abcdef

  • C:\abcuvwxy

*\abc*a.exe

  • temp\abc1a.exe

  • home\abc1a.exe

  • test\abc2a.exe

Question mark

?

one character

?:\xxx\ausnahme.exe

  • C:\XXX\ausnahme.exe

  • Z:\xxx\ausnahme.exe

?:\xxx\*.exe

  • C:\xxx\.exe

  • Z:\xxx\yyy\ausnahme.exe

/root/xxx/ausnahme?.txt

  • /root/xxx/ausnahme1.txt

  • /root/xxx/ausnahme2.txt

Wildcards as part of the name

All literals (* or ?) are interpreted as wildcards. If these occur in a path or in a command line, always specify the character ? as the wildcard.

/root/xxx/ausnahme?.txt

/root/xxx/ausnahme?.txt

/root/xxx/ausnahme?.txt

/root/xxx/ausnahme*.txt

Registry Exclusions

  • Specify the absolute path.

  • Case is not considered.

  • The entries must use the full hive names (e.g., HKEY_LOCAL_MACHINE, not the short forms HKLM).

  • Exclusions in HKEY_CURRENT_USER must be clearly assigned to a specific user or to all users:

    • specific user SID:
      \registry\user\s-1-5-21-0123456789-0123456789-0123456789-0123\

    • all users:
      \registry\user\*\
Character Example Result

Asterisk

*

Everything is excluded

*\xxx\*\ausnahme

  • \registry\machine\xxx\abc\ausnahme

  • \registry\user\xxx\yyy\zzz\ausnahme

Question mark

?

one character

*\xxx?\ausnahme

  • \registry\machine\xxx1\ausnahme

  • \registry\machine\xxx2\ausnahme

  • \anotherregistry\machine2\xxx1\ausnahme

How can Exclusions be created?

You have the option to create Exclusions in 3 ways:

  • via the input form in the Exclusions area.

  • via quarantine entries.

  • via Alerts.