Cb Defense: "Ransomware rules cannot have action DENY" Error When Modifying Policy

[#1]

Environment

• Cb Defense: All Versions

Symptoms

• Although default rules for "Performs ransomware-like behavior" have never been touched, the Advanced policy shows that all rules for "Performs ransomware-like behavior" are set to "Deny operation"
  
• When switching to edit mode the "Terminate process" actions is not enabled for "Performs ransomware-like behavior" rules and the "Deny operation" isn't even an option.
  
• Receiving "Error saving sensor settings Error modifying policy: Ransomware rules cannot have action DENY" after trying to save a change to the built-in Advanced policy.
  

Resolution

Please set all "Performs ransomware-like behavior" rules in the Advanced Policy to action "Terminate process" before saving any changes. Simply denying ransomware access to the first file an application tries to encrypt would not prevent it from attempting future encryption operations.

Related Content

Cb Defense: How To Enable Enhanced Ransomware Protection