Last active
February 21, 2023 18:42
-
-
Save mgeeky/acc779ce8ffcd5ddd6fa85702bba70db to your computer and use it in GitHub Desktop.
Symantec Endpoint Protection directory exclusion registry key. According to M-Trends 2018, one of techniques used to overcome active AV scanning is to create a directory for files drop and to add it into AV's exclusion via registry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Windows Registry Editor Version 5.00 | |
| [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Symantec\Symantec Endpoint Protection\AV\Exclusions\ScanningEngines\Directory\Client\1733004144] | |
| "Owner"=dword:00000004 | |
| "ProtectionTechnology"=dword:00000001 | |
| "FirstAction"=dword:00000011 | |
| "SecondAction"=dword:00000011 | |
| "DirectoryName"="C:\\to\\be\\excluded\\" | |
| "ThreatName"="C:\\to\\be\\excluded\\" | |
| "ExcludeSubDirs"=dword:00000001 | |
| "ExtensionList"="" | |
| "ScanCategories"=dword:ffffffff |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment