This is an extension for Drive Badger. It provides exclude.list file, containing a list of exclusions compatible with popular rsync program.

The purpose of these exclusions is to decrease the amount of data to be exfiltrated by Drive Badger, and thus to speed up the attack, by eliminating files and directories, that are not valuable in any way to the attacker:

• Hyper-V virtual machine state files (current format VMRS and legacy BIN)
• ISO images

Installing

Clone this repository as /opt/drivebadger/config/exclude-virtual directory on your Drive Badger persistent partition.

When you install this extension, you should also install hook-virtual hook - it dynamically applies additional exclude rules.

More information

• Drive Badger main repository
• Drive Badger wiki
• description, how configuration repositories work