Feature request: Malware exclusion extension using wildcard paths

[jezmbi]

I have a some false positive malware detections for the extension .hidden. These all exist within subfolders of node_modules folders, the path to these folders can change regularly when new software versions are deployed.

I do not wish to exclude all *.hidden files in case of a real malware detection.

I would like the ability to exclude an extension if it is within any node_modules folder, eg. **\node_modules\**\*.hidden

I have also noted that when viewing the malware detection log suspicious_files_dd-mm-yy.log there are more entries in the logfile than I see in the UI.

Case: #07301191

Thanks

[Mildur]

Hello Jezmbi

Thanks for your request about wildcards in folder paths.
We know about the request and that it is important for our customers. Your vote is counted.

Best,
Fabian

[poolshark1]

Hi Fabian,

I am also anxiously awaiting the ability to use wildcards in malware detection "trusted objects" settings. Any update on when we can expect that functionality?

On a related note, I find it curious that wildcards are already supported in the "suspicious files" settings. Why wildcard support for inclusions, but not exclusions?

Thanks

[MoritzG-Seidemann]

Another vote from me. Would be very useful

[StoopidMonkey]

I'm bumping this. Without the ability to use wildcards or environment variables this feature is unusable for user profile directories due to the false alarms. For example, I frequently got hits for "bulk file deletion" on paths like:
c:\Users\[username]\AppData\Local\Microsoft\Edge\User Data\

Right now I have no choice but to exclude the entire C:\Users path instead of just the c:\Users\*\AppData\Local\Microsoft\Edge\ folder for all users.

[dspringer]

Hi there

This topic seems to be most suitable for my request and so I will also bump it.

I am once again annoyed by the fact that I have false positives for potentially dangerous file extensions and it is always a thorn in my side to simply declare the entire server as sighted OK.
But I also don't want to simply make a global exclusion for “*.AREA” files, for example, just because a lab software uses exactly this extension. It would be more appropriate to be able to make the exclusion for this one server in exactly this path.

Therefore: Thumbs up for this topic