GuardMode 2023.2
Catalogic WebsiteDocumentation
  • Intro
  • Installation
    • System requirements
    • Installing GuardMode Agent on Windows
      • Updating GuardMode Agent on Windows
    • Installing GuardMode Agent on Linux
    • Uninstalling GuardMode Agent on Windows
    • Uninstalling GuardMode Agent on Linux
    • Configuring GuardMode Agent for SAMBA setup
    • Uninstalling GuardMode Agent on SAMBA setup
  • Agent Configuration
    • General Settings
    • Excluded Paths Configuration
    • Adding malware detection rules
      • Honeypot and Decoy Files
      • Write Operations Threshold
      • Detecting File Renaming with Abnormal File Extensions
      • Special Files Monitoring
    • Security Incident Detection
    • SMB Monitoring (Linux Only)
    • Event Reports
      • Configuring Event Reports
      • Excluding Paths From Event Reports
      • Tagging Agent
    • NFS Share Monitoring
    • Altering Audit Rules
    • Changing Blocklist Configuration
  • Using GuardMode Agent Command Line
    • Agent CLI Reference
  • REST API Documentation
  • On-demand Scanning
  • Logging
  • FAQ
  • Found an issue?
Powered by GitBook
On this page
  1. Agent Configuration

Adding malware detection rules

PreviousExcluded Paths ConfigurationNextHoneypot and Decoy Files

GuardMode provides you with many customizable methods of detecting ransomware on your device:

To modify any of the options select the Nodes tab from the DPX Dashboard, click on your GuardMode Agent Node, and select the Security tab:

Honeypot and decoy files
Write operations threshold
Detecting file renaming with abnormal file extensions