Exploit mitigation or ransomware wildcards and variables and using the "$" variable

Hi Slappy,

Thanks for reaching out to the Sophos Community Forum. 

I was able to look into the support case you mentioned and the exclusion does appear to be populated correctly. 

Do you know if the device was rebooted between detections? Typically, Sophos will cache previously detected items and continue to block them until a reboot clears the app to allow it once again. 

Have not restarted the PC I am testing this on.  If you add an exclusion with the path where the file is located and just "update" Sophos, the path exclusion works.....So logic would indicate reboot should not be necessary for this "$" exclusion to work.

Finally was able to get the exclusion syntax that was needed.  In global exclusion added  Exclusion Type being: Exploit Mitigation (Windows) and then entered  the correct syntax is:  " **\<filename>   This seems to have excluded the file no matter where the EXE file was located on the C: drive.

Still would like to have the documentation cleaned up to reflect this......

Thanks for following up to share the solution you found. 

Regarding your comment below, is the "app.exe" something that can be run stand-alone for testing purposes, or will this only work within your environment?

It may be worthwhile to inquire further with support to find out why the $ variable is not working correctly.