Application with "conf.json" blocked without events

Question

Hi, 
 I have a Application with unc path "\server-01	est$\xyz.exe". 
 The shortcut of the application is in the same folder with "conf.json" in it. 
 Sophos Central blocked this program without any events! 
 Can anybody help ? 
 best regards, 
 Thomas

Thomas_LSW · Accepted Answer

Hashing exclusion " \ww2mws-02\celano$\bdeww2_celCAP4.0\bin\celElectronApp-win32-x64\celElectronApp.exe" 
 solves the problem - I re-enabled "Generate file hashes remotely for event logging". 
 Thank you.

Sophos User930 · Answer

We can probably refine it. So you can re-enable the other options and enable "Generate file hashes remotely for event logging" again, so it "breaks". 
 Then in exclusions, could be global or on a threat protection policy basis, add a new exclusion of type "Hashing exclusions (Windows)" 
 Now, I'm not sure which file being hashed is the issue so you might need to experiment, you could try a file/folder for: \ww2mws-02\celano$\bdeww2_celCAP4.0\bin\celElectronApp-win32-x64\celElectronApp.exe If that fails maybe a file/folder for: \ww2mws-02\celano$\bdeww2_celCAP4.0\bin\celElectronApp-win32-x64\ or \ww2mws-02\celano$\bdeww2_celCAP4.0\ Maybe a process for: \ww2mws-02\celano$\bdeww2_celCAP4.0\bin\celElectronApp-win32-x64\celElectronApp.exe In either case, hopefully one of these will work. They end up at the endpoint in the registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\EventJournal\Config JournalExcludeHashingFilePaths or JournalExcludeHashingProcessFilePaths When you excluded all remote files from being hashed by the journaling feature, it would have set: JournalExcludeHashingRemoteFiles to 1 but you shouldn't need to stop hashing all remote files. Note: This isn't for scanning purposes, this is all about journaling data, specially recoding hashes of files for the journal data.

Application with "conf.json" blocked without events

Top Replies