cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
avilt
Level 9
Report Inappropriate Content
Message 1 of 6

Blocking Based on Hash

Jump to solution

I am using VSE with ePO and I am unable to define blocking based on hash value without HIPS which is not deployed.

If I replace ePO-VSE with ENS, can I define block rules based on hash value?

2 Solutions

Accepted Solutions
jess_arman
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Blocking Based on Hash

Jump to solution

@avilt You can use ENS Exploit Prevention Expert Rules to achieve this, yes. Please see the ENS Threat Prevention Product Guide PD27574 and Expert Rules Reference Guide PD27227, for more information.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

ktankink
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: Blocking Based on Hash

Jump to solution

ENS Access Protection rules can be created to prevent file execution by hash as well (e.g., PROCESSES subrule type and block the RUN operation for a Target Executable within a Subrule).

View solution in original post

5 Replies
jess_arman
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Blocking Based on Hash

Jump to solution

@avilt You can use ENS Exploit Prevention Expert Rules to achieve this, yes. Please see the ENS Threat Prevention Product Guide PD27574 and Expert Rules Reference Guide PD27227, for more information.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

ktankink
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 6

Re: Blocking Based on Hash

Jump to solution

ENS Access Protection rules can be created to prevent file execution by hash as well (e.g., PROCESSES subrule type and block the RUN operation for a Target Executable within a Subrule).

View solution in original post

avilt
Level 9
Report Inappropriate Content
Message 4 of 6

Re: Blocking Based on Hash

Jump to solution

Thank you

So with ENS, with antivirus product itself we will be able to achieve this objective without HIPS.

jess_arman
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 6

Re: Blocking Based on Hash

Jump to solution

@avilt Yes, because ENS is a single platform, multi-module solution to allow for wider functionality under one product.

You can get started with the ENS FAQs article KB86704

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

avilt
Level 9
Report Inappropriate Content
Message 6 of 6

Re: Blocking Based on Hash

Jump to solution

Currently I see only 3 features (Antivirus, Firewall, Web Control)

How about white-listing and removable device control? How do I activate them?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community