nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Directory Exceptions #16

Open abg-andrew opened 7 years ago

abg-andrew commented 7 years ago

Is it possible to implement a list of directories to be excluded from the CryptoBlocker screening? I have software such as Trend that seems to use multiple detected file type exceptions in it's own folders. I'd rather except the C:\Program Files\Trend directory from the screen then remove a number of monitored extensions using the skiplist.txt file.

JustinCochran commented 7 years ago

I would also like to see something like this as well. Thanks!

nexxai commented 7 years ago

Lines 121-125 are where the script determines which locations to protect. If you'd like to modify the locations, this would be where you'd want to look. However since those changes would likely be overwritten with any successive script update, what I'd suggest is looking at a way to prompt the user for some kind of choice (e.g. "Press 1 to enumerate and protect all drives, Press 2 to enumerate and protect all shares, Press 3 to provide a comma-separated list of folders to protect") and then store that in some kind of settings file.

If you happen to do this, please submit a pull request as I'd like to see those changes in the script too.

JustinCochran commented 7 years ago

For mine I used the same method that was used for the File extension skiplist. I Created a file called DriveExclusions.txt. Then I added code to test if the file exists, and if it does: $drivesContainingShares = $drivesContainingShares | Where-Object { $DriveExclusions -notcontains $_ }

I have only Tested this on Server 2008/2008 R2 and Server 2012 R2

Boris0791 commented 6 years ago

Hello, I would like to monitor only a specific directory (example d:\data) without the other shared directories being screened. I know the change is to be made on line 121-125 but I have not succeeded. Could you show me an example to screen only a specific directory? Thank you in advance, Boris

StarDestroyer78 commented 6 years ago

Boris0791 - I liked that idea. In order to implement it, I created a "ProtectList.txt" file ... I then updated to code to read that file in (if it exists) and only protect those directories. If the file doesn't exist, then it just does what it currently does.

I'm new to git, so I don't know if I did everything right, but I tried to add this as a pull request (which I think is the proper way to submit a patch): https://github.com/nexxai/CryptoBlocker/pull/43

Boris0791 commented 6 years ago

Hello StarDestroyer78,

Pefect ! Thank you for the customization, it's work without problem :-)

Boris