Honeypot files in OneDrive synced folder

[Marcus_Halmsjo]

Hi,

We have enabled the onedrive secured folder feature on our clients meaning onedrive syncs and handles the desktop, documents and pictures folders.

Our problem now is that sandblast agent creates honeypot folders for malware and cryptoware and these folder can have illegal  characters like ! and ´ which onedrive does not allow in synced folder names.

Me personally i just ignore any sandblast folder sync error message but the organisation will not accept this red error message on folders and sync.

Anyone know of this issue and or any solutions?

[_Val_]

I think you can exclude some folders from operation:

SandBlast Agent (Forensics, Anti-Ransomware, Anti-Bot, Threat Emulation) - Exclusions 

[Marcus_Halmsjo]

Thanks for the link will definitely come in handy but i don't think it apply to this since it is not a scan to exclude in that sense it is passive files only in the documents/pictures/movies folders, sandblast creates this folder and it looks random, now i have a folder named "-Sandblast Zero-DayFrameworkFilesDo not-Delete" containing random files and works fine, another user has a folder name "CPSystemFilesDon'tDiscard" and that gives error because of the ' .

Still want the folders though since they fill a very important role just the special characters that messes things up.

[Tom_Kendrick]

Hi Marcus, 

I have had this issue reported by another customer. 

I spoke to R&D who are hoping to include a fix in E80.94 (the next version) expected approx. 1 month away.  If you have any other examples please share.

Once I have a definitive answer I will mail you.

Tom Kendrick

Customer Success Manager (EMEA)

[Marcus_Halmsjo]

Thanks that is good news, not seen any other then ! and ' so far but from my experience when migrating files to sharepoint online and onedrive the only special character you can use safely in folder names now is dash

[Liam_Finch]

Fixed this myself this morning.

Simply change the filename's and remove the spaces/illegal characters and OneDrive is happy.

[Marcus_Halmsjo]

These folders are special they are created by sandblast agent to monitor unwanted changes in files so manually change the names does not seem like a good idea and they seem to be randomly created for every user.

[Liam_Finch]

It worked for me Marcus without any issues.