cancel
Showing results for 
Search instead for 
Did you mean: 
Post a Question

Honeypot files in OneDrive synced folder

Hi,

We have enabled the onedrive secured folder feature on our clients meaning onedrive syncs and handles the desktop, documents and pictures folders.

Our problem now is that sandblast agent creates honeypot folders for malware and cryptoware and these folder can have illegal  characters like ! and ´ which onedrive does not allow in synced folder names.

Me personally i just ignore any sandblast folder sync error message but the organisation will not accept this red error message on folders and sync.

Anyone know of this issue and or any solutions?

7 Replies

Re: Honeypot files in OneDrive synced folder

0 Kudos

Re: Honeypot files in OneDrive synced folder

Thanks for the link will definitely come in handy but i don't think it apply to this since it is not a scan to exclude in that sense it is passive files only in the documents/pictures/movies folders, sandblast creates this folder and it looks random, now i have a folder named "-Sandblast Zero-DayFrameworkFilesDo not-Delete" containing random files and works fine, another user has a folder name "CPSystemFilesDon'tDiscard" and that gives error because of the ' .

Still want the folders though since they fill a very important role just the special characters that messes things up.

0 Kudos
Employee
Employee

Re: Honeypot files in OneDrive synced folder

Hi Marcus, 

I have had this issue reported by another customer. 

I spoke to R&D who are hoping to include a fix in E80.94 (the next version) expected approx. 1 month away.  If you have any other examples please share.

Once I have a definitive answer I will mail you.

Tom Kendrick

Customer Success Manager (EMEA)

Re: Honeypot files in OneDrive synced folder

Thanks that is good news, not seen any other then ! and ' so far but from my experience when migrating files to sharepoint online and onedrive the only special character you can use safely in folder names now is dash

0 Kudos

Re: Honeypot files in OneDrive synced folder

Fixed this myself this morning.

Simply change the filename's and remove the spaces/illegal characters and OneDrive is happy.

0 Kudos

Re: Honeypot files in OneDrive synced folder

These folders are special they are created by sandblast agent to monitor unwanted changes in files so manually change the names does not seem like a good idea and they seem to be randomly created for every user.

0 Kudos

Re: Honeypot files in OneDrive synced folder

It worked for me Marcus without any issues. 

0 Kudos