Define bypass rules

Define specific rules in a policy to bypass applied memory-protection and other techniques.

Some applications (as part of their day-to-day processing) run code in an atypical way and hence are prevented from running. To allow such applications to run, define appropriate bypass rules. A bypassed file or application is no longer considered by the memory-protection features of Application Control.

On the ePO - On-prem console, perform one of these actions.
- Create an Application Control policy or rule group.
- Create an Application Control policy (to apply bypass rules to one endpoint).
Select the Exclusions tab.
Click Add to open the Add exclusion rules dialog box.
Expand nodes for the options where you want to add bypass rules.
- Memory protection
- Installation detection
- Advanced options
(Optional) Select the Memory protection options where you want to add bypass rules, then provide the needed information.
- Disable buffer overflow protection (CASP) for a process — Specify a process in the Process Name field to bypass the process from the Critical Address Space Protection (CASP) technique.
- Disable buffer overflow protection (NX) for a process on 64-bit Windows — Specify a process in the Process Name field to bypass the process from the No eXecute (NX) technique. Select Enable Inheritance to bypass child processes started by the file from the No eXecute (NX) technique.
- Disable ROP protection for a process using Forced Relocation (VASR) — Specify a process in the Process Name field to bypass the process from the VASR Forced-Relocation technique. Optionally, specify the name of the DLL file associated with the process in the Library Name field.
- Disable ROP protection for a DLL using DLL Relocation (VASR) — Specify a DLL file in the Library Name field to bypass the DLL file from the VASR DLL Relocation technique. The file isn't rebased and is loaded from its preferred base address.
- Disable ROP protection for a process using Stack Randomization (VASR) — Specify a process in the Process Name field to bypass the process from the VASR Process Stack Randomization technique.
(Optional) Select Allow uninstallations and provide the needed information.
(Optional) Select Advanced options where you want to add bypass rules, then provide the needed information.
- Exclude file from write-protection rules and allow script execution — Specify a process in the Process Name field to bypass the process from write protection rules and also allow execution for a script file using the Process Context File Operations bypass technique. Optionally, specify the name of the parent process in the Parent Process Name field to allow the file to bypass only if it is launched by the specified parent.
- Ignore path for file operations — Specify a path in the Relative Path field to allow execution of binaries on Windows 64-bit platforms (including PE32 types). The system excludes the path from the deny-exec feature by using the skiplist -i command. You must restart the system to apply this rule.
- Exclude path from file operations — Specify a path in the Relative Path field to exclude it from file operations and script-auth by using the skiplist -f command. This setting disables write protection for file creation, modification, and deletion. Link and rename operations remain protected. Use this option for frequently updated (“noisy”) files, such as logs.
- Exclude path from write-protection rules, specify a relative path in the Relative Path field to bypass the relative path from file write protection rules using the skiplist -d command.
- Exclude local path and all its contained files and sub-directories from the allow list, specify a local path in the Path field to bypass the local path and all its contained files and subdirectories from the allow list using the skiplist -s command.
- Exclude volume from Application Control protection, specify a volume in the Volume field to bypass the volume from Application Control protection using the skiplist -v command. This option detaches the specified volume from the allow list and the volume is not protected by Application Control.
Click OK to apply the rules.
Important
Contact Trellix Support before applying these exclusions.