topic Re: Honeypot files in OneDrive synced folder in Endpoint

Honeypot files in OneDrive synced folder

Marcus_Halmsjo — Wed, 13 Feb 2019 11:02:11 GMT

Hi,

We have enabled the onedrive secured folder feature on our clients meaning onedrive syncs and handles the desktop, documents and pictures folders.

Our problem now is that sandblast agent creates honeypot folders for malware and cryptoware and these folder can have illegal characters like ! and ´ which onedrive does not allow in synced folder names.

Me personally i just ignore any sandblast folder sync error message but the organisation will not accept this red error message on folders and sync.

Anyone know of this issue and or any solutions?

Re: Honeypot files in OneDrive synced folder

_Val_ — Wed, 13 Feb 2019 13:18:15 GMT

I think you can exclude some folders from operation:

SandBlast Agent (Forensics, Anti-Ransomware, Anti-Bot, Threat Emulation) - Exclusions

Re: Honeypot files in OneDrive synced folder

Marcus_Halmsjo — Wed, 13 Feb 2019 14:02:25 GMT

Thanks for the link will definitely come in handy but i don't think it apply to this since it is not a scan to exclude in that sense it is passive files only in the documents/pictures/movies folders, sandblast creates this folder and it looks random, now i have a folder named "-Sandblast Zero-DayFrameworkFilesDo not-Delete" containing random files and works fine, another user has a folder name "CPSystemFilesDon'tDiscard" and that gives error because of the ' .

Still want the folders though since they fill a very important role just the special characters that messes things up.

Re: Honeypot files in OneDrive synced folder

Tom_Kendrick — Fri, 15 Feb 2019 09:10:29 GMT

Hi Marcus,

I have had this issue reported by another customer.

I spoke to R&D who are hoping to include a fix in E80.94 (the next version) expected approx. 1 month away. If you have any other examples please share.

Once I have a definitive answer I will mail you.

Tom Kendrick

Customer Success Manager (EMEA)

Re: Honeypot files in OneDrive synced folder

Marcus_Halmsjo — Fri, 15 Feb 2019 13:06:21 GMT

Thanks that is good news, not seen any other then ! and ' so far but from my experience when migrating files to sharepoint online and onedrive the only special character you can use safely in folder names now is dash

Re: Honeypot files in OneDrive synced folder

Liam_Finch — Sat, 16 Feb 2019 14:15:18 GMT

Fixed this myself this morning.

Simply change the filename's and remove the spaces/illegal characters and OneDrive is happy.

Re: Honeypot files in OneDrive synced folder

Marcus_Halmsjo — Mon, 18 Feb 2019 06:36:18 GMT

These folders are special they are created by sandblast agent to monitor unwanted changes in files so manually change the names does not seem like a good idea and they seem to be randomly created for every user.

Re: Honeypot files in OneDrive synced folder

Liam_Finch — Mon, 18 Feb 2019 10:53:25 GMT

It worked for me Marcus without any issues.