Environment
Symptoms
- Although default rules for "Performs ransomware-like behavior" have never been touched, the Advanced policy shows that all rules for "Performs ransomware-like behavior" are set to "Deny operation"

- When switching to edit mode the "Terminate process" actions is not enabled for "Performs ransomware-like behavior" rules and the "Deny operation" isn't even an option.

- Receiving "Error saving sensor settings Error modifying policy: Ransomware rules cannot have action DENY" after trying to save a change to the built-in Advanced policy.

Resolution
Please set all "Performs ransomware-like behavior" rules in the Advanced Policy to action "Terminate process" before saving any changes. Simply denying ransomware access to the first file an application tries to encrypt would not prevent it from attempting future encryption operations.
Related Content
Cb Defense: How To Enable Enhanced Ransomware Protection