The list below shows items that you must NOT exclude with SentinelOne exclusions. If you create an exclusion for any of these items, you open your environment to security risk and void the SentinelOne Ransomware Warranty for the site.
If you have an interoperability or false positive issue that you need help to resolve, please open a ticket with the Continuum SOC.
NOT Recommended Exclusions:
- Signer identity exclusion for all Microsoft applications
- Signer identity exclusion for all Adobe applications
- <Drive letter>:\
- <Drive letter>:\*.*
- <Drive letter>:\*\
- <Drive letter>:\Windows\spool\
- C:\*\Java\
- C:\cygwin\
- C:\cygwin64\
- C:\Java\
- C:\jboss-eap-6.4\
- C:\Program Files (x86)\
- C:\Program Files (x86)\Adobe\
- C:\Program Files (x86)\Google\
- C:\Program Files (x86)\Google\Chrome\
- C:\Program Files (x86)\Internet Explorer\
- C:\Program Files (x86)\Java\
- C:\Program Files (x86)\Java\jre<version number>\
- C:\Program Files (x86)\Java\jre1.8.0_151\bin\jp2launcher.exe
- C:\Program Files (x86)\Java\jre6\bin\
- C:\Program Files (x86)\Microsoft Office\
- C:\Program Files (x86)\Microsoft Office\Office<version number>\
- C:\Program Files (x86)\Microsoft Office\root\Office16\
- C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.exe
- C:\Program Files(x86)\Java\
- C:\Program Files\
- C:\Program Files\Adobe\
- C:\Program Files\Adobe\Acrobat Reader DC\
- C:\Program Files\Adobe\Reader 10.0\Reader\AcroRd32.exe
- C:\Program Files\cygwin\
- C:\Program Files\cygwin64\
- C:\Program Files\Git\perl.exe
- C:\Program Files\Git\usr\bin\perl.exe
- C:\Program Files\Internet Explorer\
- C:\Program Files\Internet Explorer\iexplore.exe
- C:\Program Files\Java\
- C:\Program Files\Java\*\bin\javac.exe
- C:\Program Files\Microsoft Office\Office16\
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
- C:\Program Files\Tripwire\TE\Agent\jre\bin\java.exe
- C:\Tomcat7\
- C:\tomcat7_2\bin\tomcat7.exe
- C:\tomcat7.0\
- C:\tomcat7\bin\tomcat7.exe
- C:\Users\*\Cygwin\Bin\
- C:\Windows\
- C:\Windows\*\WindowsPowerShell\v1.0\powershell.exe
- C:\Windows\explorer.exe\
- C:\Windows\py.exe
- C:\Windows\setup.exe
- C:\Windows\system32\
- C:\Windows\System32\smss.exe
- C:\Windows\system32\conhost.exe
- C:\windows\system32\consent.exe
- C:\Windows\System32\cscript.exe
- C:\Windows\system32\csrss.exe
- C:\Windows\System32\dllhost.exe
- C:\Windows\System32\dwm.exe
- C:\Windows\System32\explorer.exe
- C:\Windows\System32\LogonUI.exe
- C:\Windows\System32\lsalso.exe
- C:\WINDOWS\system32\lsass.exe
- C:\Windows\System32\lsm.exe
- C:\windows\system32\mmc.exe
- C:\Windows\System32\netsh.exe
- C:\Windows\System32\Ntoskrnl.exe
- C:\Windows\System32\rundll32.exe
- C:\windows\system32\services.exe
- C:\Windows\System32\sihost.exe
- C:\Windows\system32\smss.exe
- C:\Windows\System32\snmp.exe
- C:\Windows\System32\splwow64.exe
- C:\Windows\System32\Spool\
- C:\Windows\System32\spoolsv.exe
- C:\Windows\System32\svchost.exe
- C:\Windows\System32\sysvol\
- C:\Windows\System32\taskeng.exe
- C:\Windows\System32\taskhostex.exe
- C:\Windows\System32\Taskmgr.exe
- C:\Windows\system32\userinit.exe
- C:\Windows\System32\vbscript.dll
- C:\Windows\system32\vssvc.exe
- C:\Windows\System32\WBEM\
- C:\Windows\System32\wbem\WmiApSrv.exe
- C:\Windows\System32\wbem\WmiPrvSE.exe
- C:\Windows\System32\WindowsPowerShell\
- C:\Windows\System32\WindowsPowerShell\v1.0\
- C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
- C:\Windows\System32\wininit.exe
- C:\Windows\system32\winlogon.exe
- C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\
- C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
- C:\Windows\SYSVOL\
- C:\Windows\SysWOW64\
- C:\Windows\SysWOW64\dllhost.exe
- C:\Windows\SysWOW64\wbem\
- C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
- C:\Windows\Temp\
- C:\Windows\winexesvc.exe
- acrord32.exe
- java.exe
- LogonUI.exe
- vssadmin.exe
- _mprosrv.exe
- *.dll
- *.exe
- */python<version number>
- */ruby
- *\*apache-maven*\
- *\bin\java.exe
- \adobe\
- \Device\HarddiskVolume*\
