GuardMode 2024.2
Catalogic SoftwareKnowledge BaseMySupport
  • Welcome to GuardMode!
  • Intro
  • Installation
    • System requirements
    • Installing GuardMode Agent on Windows
      • Updating GuardMode Agent on Windows
    • Installing GuardMode Agent on Linux
      • Using GuardMode Agent as a Container
    • Uninstalling GuardMode Agent on Windows
    • Uninstalling GuardMode Agent on Linux
    • Configuring GuardMode Agent for SAMBA setup
    • Uninstalling GuardMode Agent on SAMBA setup
  • Agent Configuration
    • General Settings
    • Excluded Paths Configuration
    • Adding malware detection rules
      • Honeypot and Decoy Files
      • Write Operations Threshold
      • Detecting File Renaming with Abnormal File Extensions
      • Special Files Monitoring
    • Security Incident Detection
    • SMB Monitoring (Linux Only)
    • Event Reports
      • Configuring Event Reports
      • Excluding Paths From Event Reports
      • Tagging Agent
    • NFS Share Monitoring
    • Altering Audit Rules
    • Configuring DPX for Automatic Blocklist Updates
    • Using TLS
    • Configuring YARA-X
  • Using GuardMode Agent Command Line
  • REST API Documentation
  • On-demand Scanning
  • Logging
  • FAQ
  • Found an issue?
Powered by GitBook
On this page
  1. Agent Configuration

Adding malware detection rules

PreviousExcluded Paths ConfigurationNextHoneypot and Decoy Files

Last updated 1 year ago

GuardMode provides you with many customizable methods of detecting ransomware on your device:

To modify any of the options select the Nodes tab from the DPX Dashboard, click on your GuardMode Agent Node, and select the Security tab:

Honeypot and decoy files
Write operations threshold
Detecting file renaming with abnormal file extensions