Behavior Monitoring Exception List Wildcard Support

The Behavior Monitoring exception lists support wildcard characters in the following items:

  • Approved Program List: File paths, file names, file extensions

  • Blocked Program List: File names, file extensions

Supported wildcard characters:

  • Asterisk (*): Represents any character or string of characters

  • Question mark (?): Represents a single character

Exception Type

Wildcard Usage

Matched

Not Matched

Directories

C:\*

Excludes all files and folders on the specified drive

  • C:\sample.exe

  • C:\folder\test.doc

  • D:\sample.exe

  • E:\folder\test.doc

Specific files under a specific folder layer

C:\*\Sample.exe

Excludes the Sample.exe file only if the file is located in any subfolder of the C:\ directory

  • C:\files\Sample.exe

  • C:\temp\files\Sample.exe

  • C:\sample.exe

UNC paths

\\<UNC path>\*\Sample.exe

Excludes the Sample.exe file only if the file is located in any subfolder of the specified UNC path

  • \\<UNC path>\files\Sample.exe

  • \\<UNC path>\temp\files\Sample.exe

  • R:\files\Sample.exe

    Reason: Mapped drives are not supported.

  • \\<UNC path>\Sample.exe

    Reason: The file does not exist within a subfolder of the UNC path.

File names and extensions

C:\*.*

Excludes all files with extensions in all folders and subfolders of the C:\ directory

  • C:\Sample.exe

  • C:\temp\Sample.exe

  • C:\test.doc

  • D:\sample.exe

  • C:\Sample

    Note:

    C:\Sample does not have a file extension and is therefore not excluded from scanning.

File names

C:\*.exe

Excludes all files with the .exe extension in all folders and subfolders of the C:\ directory

  • C:\Sample.exe

  • C:\temp\test.exe

  • C:\Sample.doc

  • C:\temp\test.bat

  • C:\Sample

    Note:

    C:\Sample does not have a file extension and is therefore not excluded from scanning.

File extensions

C:\Sample.*

Excludes all files with the name Sample and any extension in the C:\ directory

  • C:\Sample.exe

  • C:\Sample1.doc

  • C:\temp\Sample.bat

  • C:\Sample

    Note:

    C:\Sample does not have a file extension and is therefore not excluded from scanning.

Files in specific directory structures

C:\*\*\Sample.exe

Excludes all files located within the second subfolder layer or any subsequent subfolders of the C:\ directory with the file name and extension Sample.exe

  • C:\files\temp\Sample.exe

  • C:\files\temp\test\Sample.exe

  • C:\Sample.exe

  • C:\temp\Sample.exe

  • C:\files\temp\Sample.doc

Complex paths or file names

C:\Sam*e??.exe

Excludes all files with names that satisfy the following conditions:

  • Begin with the characters "Sam"

  • The third last character of the file name must be "e"

  • At least 1 character exists between the opening "Sam" string and closing "e??" string of the file name

  • Exactly 2 characters exist before the file extension and after the "e" in the file name

  • The file extension is .exe

If a file meets all the required conditions and is located the C:\ directory, Behavior Monitoring excludes the file from scans.

  • C:\Sample12.exe

  • C:\SamSamSample12.exe

  • C:\SaSmple12.exe

    Reason: Does not start with "Sam"

  • C:\SamSamSam12.exe

    Reason: Does not contain "e" as the third last character

  • C:\Same12.exe

    Reason: Does not include characters between the starting "Sam" string and third last "e" character

  • C:\Sample1.exe

    Reason: Does not include 2 characters before the extension and after the "e"

  • C:\Sample12.doc

    Reason: Incorrect extension
Parent topic: Configuring the Behavior Monitoring Exception List