Controlled Folder Access - Ransomware Protection, Exclusions, Trusted apps and much more..

Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It does so by checking apps against a list of trusted apps. This is particularly important during Ransomware attacks when user data can get encrypted which is normally found in common system folders.

Here is a list of Windows system folders that are protected by default:

c:\Users\<username>\Documents

c:\Users\Public\Documents

c:\Users\<username>\Pictures

c:\Users\Public\Pictures

c:\Users\Public\Videos

c:\Users\<username>\Videos

c:\Users\<username>\Music

c:\Users\Public\Music

c:\Users\<username>\Favorites

The protected folders also include boot sectors and you can add more folders, allow specific apps access to the protected folders or exclude them all together.

I recently dealt with one such application that needed to be allowed access to the protected folders. The app in question is Symantec Encryption Desktop. The first indication was when I started seeing the following error -

This didn't match any of the usual ASR rules that I had put in place, so I decided to check the good old Advanced hunting for ControlledFolderAccess events.

DeviceEvents | where ActionType Startswith 'ControlledFolderAccess'

This seemed about right and after analyzing the events, it was time to decide on the mitigation steps. Now, as stated above, one has the option to either add the app to allow access to the protected folders or exclusion it all together. Before making this decision I wanted to research on which all files are required for Symantec Encryption Desktop to work correctly. Broadcom have provided a pretty exhaustive list of the exclusions and I have captured the ones relevant to PGP below -

These locations are where PGP reads/writes data from/to:

C:\Users\[username-here]\Documents\PGP

C:\Program Files (x86)\PGP Corporation\PGP Desktop

C:\Users\[username-here]\AppData\Roaming\PGP Corporation\PGP

C:\Windows\System32\ (Allow only the following files):

PGPfsshl.dll

PGPhk.dll

PGPiconv.dll

PGPlsp.dll

PGPmapih.dll

PGPmn.dll

PGPsdk.dll

PGPsdkNL.dll

PGPsdkUI.dll

PGPtcl11.dll

PGPwinot.dll

C:\Windows\System32\drivers (allow only the following files):

PGPce.inf

PGPce.sys

PGPce.sys.sig

PGPdisk.sys

PGPfsfd.sys

PGPsdk.inf

PGPsdk.sys

Based on the list above, I decided to exclude the called out folders and files and also add the application exe in question to the trusted list of apps. 

Note: Be mindful of what all you add to the exclusions as this affects all ASR rules and not just Controlled Folder Access.

After I added the exclusions, the error didn't show up again and the application was functional again. There were no more device events raised for PGP either.

You do have the option to add additional actions against apps by using File indicators in Defender for Endpoint. This is done directly in the Defender 365 Portal.

However, to use this feature, you need to ensure the following first -

Conclusion

Even with Defender AV switched ON, Windows 10 can also provide strong protection against malware by adding an additional layer of protection against Ransomware through Controlled Folder Access. However, to ensure minimal disruption to business operations, one may need to fine tune the security policies from time to time. I have personally found helpful the idea of assessing the security settings like ASR, Controlled Folder Access deployed against a cohort group in both Audit and Block mode and then fine tuning the policies according to the business requirements.