Antivirus & EDR Configuration Guide

ActivityPulse uses Windows system APIs that may trigger behavioural detections in antivirus and EDR products. This guide provides the exclusions needed for reliable operation.

Why Does Antivirus Flag ActivityPulse?

ActivityPulse is a legitimate workforce intelligence tool, but it uses Windows APIs that are also used by malicious software:

Low level keyboard hooks for input activity counting. Same API used by keyloggers.

Clipboard monitoring. Same API used by clipboard stealers.

Process protection (DACL hardening). Same technique used by malware to resist removal.

Named pipe IPC. Same communication method used by C2 frameworks.

Registry access. Common across many software types.

Every major vendor requires antivirus exclusions. This is an industry standard deployment step, not unique to ActivityPulse.

Microsoft Defender / Windows Security

PowerShell (Run as Administrator)

PowerShell

# Process exclusions

Add-MpPreference -ExclusionProcess “ActivityPulse_Service.exe”

Add-MpPreference -ExclusionProcess “ActivityPulse_Monitor.exe”

# Path exclusion

Add-MpPreference -ExclusionPath “C:\Program Files\ActivityPulseAgent\”

Group Policy (GPO)

GPO Path

Computer Configuration > Administrative Templates >

Windows Components > Microsoft Defender Antivirus >

Exclusions

Exclusions

Path

C:\Program Files\ActivityPulseAgent\

Process

ActivityPulse_Service.exe

Process

ActivityPulse_Monitor.exe

Microsoft Intune

Navigate to Endpoint Security > Antivirus > Create Policy
Platform: Windows 10 and later
Profile: Microsoft Defender Antivirus exclusions
Add the exclusions listed above
Assign to the same device group as the ActivityPulse deployment

Manual (Windows Security UI)

Open Windows Security > Virus and Threat Protection
Click “Manage settings” under Virus and threat protection settings
Scroll to “Exclusions” and click “Add or remove exclusions”
Add folder exclusion: C:\Program Files\ActivityPulseAgent\
Add process exclusions for both agent processes

CrowdStrike Falcon

Navigate to Configuration > Prevention Policies
Select the relevant policy group
Under “Sensor Visibility Exclusions”, add the paths below
For IOA exclusions, add process paths under the IOA Exclusions tab if behavioural detections persist

Exclusions

File Path

C:\Program Files\ActivityPulseAgent\**

Process

C:\Program Files\ActivityPulseAgent\ActivityPulse_Service.exe

Process

C:\Program Files\ActivityPulseAgent\ActivityPulse_Monitor.exe

CrowdStrike exclusion configuration varies by Falcon version. Contact your CrowdStrike representative if you need assistance with exclusion policies.

SentinelOne

Navigate to Sentinels > Exclusions
Add the path and process exclusions below
Apply to the relevant site or group

Exclusions

Path

C:\Program Files\ActivityPulseAgent\

Process Path

C:\Program Files\ActivityPulseAgent\ActivityPulse_Service.exe

Process Path

C:\Program Files\ActivityPulseAgent\ActivityPulse_Monitor.exe

Other Antivirus and EDR Products

For other products, add the following exclusions using your management console.

Files and Folders to Exclude

Installation Directory

C:\Program Files\ActivityPulseAgent\

Windows Service (Session 0, SYSTEM)

ActivityPulse_Service.exe

Per User Monitor (Session 1+)

ActivityPulse_Monitor.exe

Browser Hook DLL (Optional)

ActivityPulse_Hook.dll

Encrypted Database and Log Files

data\

Registry Keys Used

Server URL Configuration

HKLM\SOFTWARE\ActivityPulseAgent\ServerUrl

Organisation Registration Key

HKLM\SOFTWARE\ActivityPulseAgent\OrganizationId

Machine Fingerprint (SHA-256)

HKLM\SOFTWARE\ActivityPulseAgent\ComputerUid

DPAPI Protected Database Key

HKLM\SOFTWARE\ActivityPulseAgent\CryptoState\EncryptedDbKey

Invisible Mode Agents

ActivityPulse supports two build types. This public guide covers the branded build only. The invisible build uses a different installation path, service name, and process names so that antivirus products treat the two builds as separate applications.

If you are deploying the invisible build, the exclusion paths and process names are different from the branded build above. Sign in to the customer portal and refer to the in portal Help Documentation for the specific exclusion values needed for your invisible build. The portal documentation is kept current with the version of the agent issued to your organisation.

The invisible build is intended for organisations that have already provided written notice of monitoring through their workplace policies. The agent itself is the same software regardless of build type. Only the installation footprint differs.

Verify Exclusions Are Working

After configuring exclusions:

CMD

# Restart the service

net stop ActivityPulseAgent && net start ActivityPulseAgent

# Verify both processes are running

tasklist | findstr /i ActivityPulse

Check the portal. The agent should show as “Online” within 60 seconds. If the agent is still being blocked, check your antivirus quarantine log and threat history for any remaining detections.