Press CTRL+K to open search

Adding registry exclusions to real-time indicator detection

  • Published on Sep 8, 2026
  • 2 minute(s) read
Prev Next
Real-time Indicator detection: registry key exclusions

Trellix Endpoint Security (HX) Agent has hardcoded registry keys related to malware persistence and execution. Real-Time Indicator Detection (RTID) monitors these specific keys rather than all system registry keys.

Excluding registry keys is usually unnecessary for performance tuning. However, in rare cases, adding exclusions for specific keys, subkeys, or values can be beneficial if you observe high rates of changes to them.

Note

The agent examines RTID process exclusions before it processes registry exclusions when parsing registry events.

Important

Trellix recommends that you only use this feature after consulting with Trellix Support. The monitored registry keys are subject to change and are not currently published.

Exclude_registry_keys_from_Real_Time_Indicator_detection.jpg
To add registry exclusions to real-time indicator detection

  1. Log in to the HX Web UI as an administrator.

  2. From the Admin menu, select Policies to access the Policies page.

  3. From the Policies table, select the Agent Default Policy and click the policy link to access the Edit Policy page.

  4. Select the Real-Time Indicator Detection tab.

  5. Verify that the Real-Time Indicator Detection ON/OFF switch is set to ON.

  6. Select the hive corresponding to the relevant key. Registry hives are defined as follows:

    • LocalMachine: Matches HKEY_LOCAL_MACHINE\.

    • CurrentControlSet: Matches the active CurrentControlSet key beneath HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet.

    • Users: Matches HKEY_USERS\<any SID>

    • ClassesRoot: Matches HKEY_LOCAL_MACHINE\SOFTWARE\Classes and its aliases HKEY_CLASSES_ROOT and HKEY_CURRENT_USER\Software\Classes

Examples:

  1. Exclude all values beneath the monitored key:

    • Hive: CurrentControlSet

    • Key path: Services\example1

    • Optional value(s):<empty>

    This excludes all registry events for all values directly in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.

    This appears in the policy as: {"hive":"CurrentControlSet","path":"Services\\example1\\","values":[]}

  2. Exclude a specific value beneath the monitored key:

    • Hive: CurrentControlSet

    • Key path: Services\example2\

    • Optional value(s): examplevalue

    This excludes all registry events for the examplevalue value only in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\example2\.

    This appears in the policy as: {"hive":"CurrentControlSet","path":"Services\\example2","values":["examplevalue"]}

Important

  • Wildcards are not supported.

  • Matches require an exact match against a specific value beneath a key or all values within a specific key.

  • Registry exclusions apply only to values, not keys.

  • Registry exclusions to a specific key path do not extend to subkeys or values in subkeys.

:
Related articles