How to Add Exclusions to Veeam Threat Hunter Scan

To exclude specific files or folders from Veeam Threat Hunter scans, add a registry entry on your Veeam Backup Server:

Registry Path: HKLM\SOFTWARE\Veeam\Veeam Threat Hunter\
Value Name: VTHScanExclusions
Value Type: Multi-String (REG_MULTI_SZ)
Value Data: See guidelines below

How to Enter Exclusions:

• Enter one exclusion per line.
• You can exclude files, folders, or both.
• To exclude all files in a folder, use a backslash \ and a wildcard * at the end.
  Example: Documents\* (excludes all files in any folder named Documents)
• Wildcards (*) can be used anywhere in the exclusion text—at the beginning, middle, or end.
  Example: *\temp* (matches any folder or file that begins with "temp")
• If you do not start your exclusion with a backslash or wildcard, one will be added automatically.
  Example: Documents* is treated as *\Documents*
• Drive letters (such as C:\) are ignored and replaced with a wildcard, so exclusions apply to all drives.
  Example: C:\Users\*\Documents\* is treated as *\Users\*\Documents\*
• Exclusion entries must be at least three characters long.

How It Works:

When a file is scanned, the Veeam Threat Hunter checks the file’s absolute path against each exclusion entry. If any exclusion entry matches that file's path, the file is skipped from the scan. Think of each exclusion entry as a simple pattern-matching filter, like a simplified RegEx; if a file's absolute path matches any part, it is skipped.

Exclusion Examples:

• *.foo is treated as *\*.foo and matches any file with the extension .foo anywhere on any drive.
• foo.txt would be treated as *\foo.txt and would match any file named foo.txt in any folder on any drive.
• foo* is treated as *\foo* and matches any file or folder that starts with foo in its name.
  • C:\Users\Administrator\Documents\foo123.txt
  • C:\Users\Administrator\Downloads\food\recipies\potpie.pdf
  • D:\Security\footage\incidents\evidence.mp4
• foo\* or \foo\* or C:\foo\* are all treated as *\foo\* and match any file path containing a folder named foo.
  • C:\foo\*
  • C:\Users\Administrator\AppData\Local\foo\*
  • C:\Users\foo\*
• \foo1*\foo2*\* is treated as *\foo1*\foo2*\* and matches any file with a folder path that contains a folder that starts with foo2* and that folder is within a folder starting with foo1*, no matter how deep in the path.
  Example:
  • E:\foo113\folder\subfolder\foo212\specimen.jpeg
  • C:\Users\foo1337\Videos\foo242\puppies.mp4