Loading...
Loading...
This article documents how to exclude files from the Veeam Threat Hunter scan.
To exclude specific files or folders from Veeam Threat Hunter scans, add a registry entry on your Veeam Backup Server: Registry Path: HKLM\SOFTWARE\Veeam\Veeam Threat Hunter\Value Name: VTHScanExclusionsValue Type: Multi-String (REG_MULTI_SZ)Value Data: See guidelines below How to Enter Exclusions: Enter one exclusion per line. You can exclude files, folders, or both. To exclude all files in a folder, use a backslash \ and a wildcard * at the end.Example: Documents\* (excludes all files in any folder named Documents) Wildcards (*) can be used anywhere in the exclusion text—at the beginning, middle, or end.Example: *\temp* (matches any folder or file that begins with "temp") If you do not start your exclusion with a backslash or wildcard, one will be added automatically.Example: Documents* is treated as *\Documents* Drive letters (such as C:\) are ignored and replaced with a wildcard, so exclusions apply to all drives.Example: C:\Users\*\Documents\* is treated as *\Users\*\Documents\* Exclusion entries must be at least three characters long. How It Works: When a file is scanned, the Veeam Threat Hunter checks the file’s absolute path against each exclusion entry. If any exclusion entry matches that file's path, the file is skipped from the scan. Think of each exclusion entry as a simple pattern-matching filter, like a simplified RegEx; if a file's absolute path matches any part, it is skipped. Exclusion Examples: *.foo is treated as *\*.foo and matches any file with the extension .foo anywhere on any drive. foo.txt would be treated as *\foo.txt and would match any file named foo.txt in any folder on any drive. foo* is treated as *\foo* and matches any file or folder that starts with foo in its name. C:\Users\Administrator\Documents\foo123.txt C:\Users\Administrator\Downloads\food\recipies\potpie.pdf D:\Security\footage\incidents\evidence.mp4 foo\* or \foo\* or C:\foo\* are all treated as *\foo\* and match any file path containing a folder named foo. C:\foo\* C:\Users\Administrator\AppData\Local\foo\* C:\Users\foo\* \foo1*\foo2*\* is treated as *\foo1*\foo2*\* and matches any file with a folder path that contains a folder that starts with foo2* and that folder is within a folder starting with foo1*, no matter how deep in the path.Example: E:\foo113\folder\subfolder\foo212\specimen.jpeg C:\Users\foo1337\Videos\foo242\puppies.mp4
Veeam Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.