Exploit mitigation or ransomware wildcards and variables and using the "$" variable

Hi Slappy,

Thanks for reaching out to the Sophos Community Forum. 

I was able to look into the support case you mentioned and the exclusion does appear to be populated correctly. 

Do you know if the device was rebooted between detections? Typically, Sophos will cache previously detected items and continue to block them until a reboot clears the app to allow it once again. 

Have not restarted the PC I am testing this on.  If you add an exclusion with the path where the file is located and just "update" Sophos, the path exclusion works.....So logic would indicate reboot should not be necessary for this "$" exclusion to work.

Have not restarted the PC I am testing this on.  If you add an exclusion with the path where the file is located and just "update" Sophos, the path exclusion works.....So logic would indicate reboot should not be necessary for this "$" exclusion to work.