Anti-Exploit exclusion

[Drea]

@pbust

I just want to make sure I understand this right,

" The Anti-Exploit exclusions are only for detections of exploit techniques in Layer3 (Application Behavior Protection). If the block happens in any of the other 3 layers which deal with memory based exploit mitigations, there is no file or folder to exclude as the block happens earlier in the chain. "

So, you're saying that it is not necessary to add exclusions because an error or virus, etc, has not been detected?  

Edited July 12, 2016 by celee

[pbust]

Welcome to the forum Drea.

MBAE includes 4 layers of protection, from Layer0 to Layer3. Some detections happen in Layers0 or Layer1 which is very early in the attack chain, way before the malware payload is even delivered from the attacker to the machine. Some detections are Layer3, where we block the malware payload from executing on the machine. Only when there is a malware payload blocked by Layer3 can we add exclusions for these types of payloads.