Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Defense: "Ransomware rules cannot have action DENY" Error When Modifying Policy

Cb Defense: "Ransomware rules cannot have action DENY" Error When Modifying Policy

Environment

  • Cb Defense: All Versions

Symptoms

  • Although default rules for "Performs ransomware-like behavior" have never been touched, the Advanced policy shows that all rules for "Performs ransomware-like behavior" are set to "Deny operation"
    ransomeware-deny-advanced.png
  • When switching to edit mode the "Terminate process" actions is not enabled for "Performs ransomware-like behavior" rules and the "Deny operation" isn't even an option.
    ransomware-terminate-advanced.png
  • Receiving "Error saving sensor settings Error modifying policy: Ransomware rules cannot have action DENY" after trying to save a change to the built-in Advanced policy.
    ransomware-deny-advanced-error.png

Resolution

Please set all "Performs ransomware-like behavior" rules in the Advanced Policy to action "Terminate process" before saving any changes. Simply denying ransomware access to the first file an application tries to encrypt would not prevent it from attempting future encryption operations.

Related Content

Cb Defense: How To Enable Enhanced Ransomware Protection

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-09-2018
Views:
745
Contributors