topic Re: Speed up Threat Emulation or ignore specific file in Endpoint

Speed up Threat Emulation or ignore specific file

64Bit — Fri, 18 Sep 2020 10:18:42 GMT

We are finding a significant delay in downloading a specific .exe application (Support-LogMeInRescue.exe). Threat emulation is set to Default (Emulate with Suspend) for .exe downloads which is ideal setting for these types of web downloads.

Is there any way to speed up Threat Emulation for Support-LogMeInRescue.exe or to add this file to an exclusion from Threat Emulation ?

Re: Speed up Threat Emulation or ignore specific file

Sigbjorn — Fri, 18 Sep 2020 11:37:07 GMT

You can add the MD5 sum of the file to the Whitelist and override the inspection settings for it.

Re: Speed up Threat Emulation or ignore specific file

64Bit — Tue, 29 Sep 2020 09:03:10 GMT

Many thanks Sigbjorn. What white list are you referring to, I can't see anywhere within Threat Extraction to add MD5 check sum?

I can only see two places where files can be excluded.

1. Inspect all domains and files except Trusted Sites

2. Prevent legitimate applications exploitation attempts

"1. Inspect all domains and files except Trusted Sites" I can see the domain could be added so that could be an option for trusted sites, there is also an option to add SHA1 HASH. Would adding a file here exclude Web Download Emulation ?

"2. Prevent legitimate applications exploitation attempts" I can see a process can be added but only as process path. Would adding file as *\Support-LogMeInRescue.exe exclude Web Download Emulation ?

Re: Speed up Threat Emulation or ignore specific file

Sigbjorn — Thu, 01 Oct 2020 05:32:22 GMT

When you're in the Threat Policy view, there's view called "Whitelist Files" under the Threat Tools in the botton left corner. In that view you can add filenames with their md5sum, and then use that in the threat policy.

Once the file is added, go back to the Threat Policy and create a new exception, choose the file you created in the "Protection/Site/File/Blade" column.