Question on On-Access Scanning

[User72676622]

If a network path is excluded from on-access scanning on a server and that server grabbed a bad file say ransomware from that network path would Endpoint Security still detect it?

[Former Member]

Hello,

Thanks for your post.

Please check the below links and that will help you.

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windo... 

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windo... 

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-client-product-guide-windo... 

If a network path is excluded from on-access scanning on a server and that server grabbed a bad file say ransomware from that network path would Endpoint Security still detect it?
If the files is doing any I/O operation and scan enabled is On in that case yes that will get scanned, If Scan is not enabled in that case no.

Scan only what you need to

Scanning some types of files can negatively affect system performance. For this reason, select these options only if you need to scan specific types of files. Select or deselect these options in the What to Scan section of the On-Access Scan settings.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[AdithyanT]

Hi @User72676622 

Thank you for your post. The above response is excellent in explaining what would happen when network files scanning is not enabled. However, in case of exclusion, I am afraid the answer may not be really that straight forward.

Why?

So by excluding a path, the first question that I would arrive at is, from where you are placing the exclusion?

What is the settings you have for On Access Scanning?

Excluding a network path is same as excluding a local path. The behavior of product would not vary from that aspect.

I would like to know what you are referring to by 

---

@User72676622 wrote:
that server grabbed a bad file say ransomware 

---

and this will definitely help me explain the end result accordingly. Looking forward to your response.

[User72676622]

The exclusion would be added to an on-access EndSec policy in Standard and Low Risk process types.  It would look similar to \\fs-p9\blabla\system\import

[AdithyanT]

Hi @User72676622 

Under low risk policy, when you exclude a path, only those processes that are defined as low risk will be using these exclusions.

You have clearly mentioned that you are adding the exclusion for both Standard and Low risk processes.  All process that are not categorized as High/Low Risk are Standard Processes and hence when they act upon the ransomware file present in remote location (access/execute/modify), no scanning will be done.

However, When a process defined as high risk (eg: abc.exe) touches any files present on that location, a Scan will be done on the file and if this is a known ransomware, detection will definitely happen.

I sincerely hope this clarifies your question!

[mmuthuga]

The file will be scanned if it was copied to the ENS machine from an excluded network path. The file on the excluded network path will not be scanned if the file was accessed, modified from the network location.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!