search

nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

File screen exception in File Screening Management #33

Open mastenzales opened 6 years ago

mastenzales commented 6 years ago

Let me be one of many whom are so thankful for hosting the list, api and providing this excellent script.

I think i found a bug , or it is I doing something wrong but. i added a File screen exception for a quickbooks directory that stores auto backup files as .adr Set allow cryptoblocker group 1 to the exception. after the script runs, the group becomes unchecked. Is there a way to adjust the script to not uncheck the groups in the exception list ?

Thank you for all you have done.

nexxai commented 6 years ago

Please use the skip list functionality to have you instance remove any filters that are blocking legitimate files in your environment.

mastenzales commented 6 years ago

Am i correct in that the skip list will allow that extension for the whole of the server? I just wanted to not block a group from a lone subdirectory. THe .adr extension may be important to block from the rest of the directories and would not want to risk that. FSRM allow you to have a file screen exception for a single directory and it allows to select exception groups. The crytoblocker script unchecks the exception group box everytime it runs. Can the script be adjusted so that it does not adjust the file screen exception settings?

nexxai commented 6 years ago

You are correct - adding an extension to the SkipList removes the block from the entire server.

There is no (easy) way to make share-specific FileGroups, because doing so would mean that every share would have its very own group of groups which could very quickly become extremely difficult to manage.

The reason all of the lists are removed and re-created each time the script is run is due to the fact that there have been rare occasions where we've had to remove a filescreen after the fact, so by cleaning them out and re-doing them means that everyone's server is protected with only the known bad extensions.

Rooven-tech commented 6 years ago

I modified the powershell script to fit my needs and got some hard sets instead of variables. What I was able to add was a Exception.txt file that will add file paths to except from Cryptoblockergroup1, Cryptoblockergroup2 and so on.

If a path is removed from the exception.txt it is not removed from FSRM but it so no longer being except from the Cryptoblockergroups. Please let me know if this is ok to share? Below is how FSRM looks. https://ibb.co/mkrfO7