Blocking MD5 Hash

[D805]

Trying to figure out how to create a rule to detect and block a specific MD5 hash value in ENS 10.0.6.1. Is this doable in ENS?

[ktankink · Accepted solution]

Hi @D805 Are you trying to block execution of an MD5 hash executable?  If so, create an Access Protection rule, and in the Subrule, use the PROCESSES engine and the RUN operation, then specify the Executable by MD5 hash only.

Example:

[PhilippM]

Hi @ktankink 

thanks for sharing this! Which eventID is used to see this in an report?

Thanks!

[DG1]

Hi @PhilippM ,

Below is the Event ID for Access Protection.

• 1092: Access protection rule violation detected and blocked (Low) - If the rule is set to block.
• 1095: Access Protection rule violation detected and NOT blocked (Low) - If the rule is set to report.