cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

VSE Blocking MD5, SHA-1 or SHA-256, is there any workaround to block this using VSE?

Jump to solution

Hi Folks,

 

I only has MA and VSE installed in my enviroment, I was wondering if there is any workaround to block MD5, SHA-1 or SHA-256 using this module. Any advise will be very appreciated.

1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 5

Re: VSE Blocking MD5, SHA-1 or SHA-256, is there any workaround to block this using VSE?

Jump to solution

Hi @Fenomeno ,

Yes, You can block the file using just the file name in VSE Access protection rule. But, its important to note that if the name of the malicious file changes, then the rule will be of no use. 

hope this helps.

- Rohit Francis 

View solution in original post

4 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: VSE Blocking MD5, SHA-1 or SHA-256, is there any workaround to block this using VSE?

Jump to solution

Hello,

 

With VSE you cannot block file with hash values.

But if you use ENS products then with the help of expert rule you can block the files.

Refer below link for more information.


Using Expert Rules in ENS to Prevent Malicious Exploits
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/using-expert-rules-in-ens-10-5-3-to-prevent-mal...

Overview of Expert Rules
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

Expert Rules training videos
https://kc.mcafee.com/corporate/index?page=content&id=KB89677

Let us know if you have any queries.

 

 

Regards,
Daya
Highlighted

Re: VSE Blocking MD5, SHA-1 or SHA-256, is there any workaround to block this using VSE?

Jump to solution
Thanks for your quick response, I would like to ask you if at VSE level in the access protection rule we can block the file process underline in the attached image could work as a workaround or no, can you please confirm that. If not I really think I need to make up my mind to start using ENS instead of VSE. Thanks again for your time and help.

Highlighted

Re: VSE Blocking MD5, SHA-1 or SHA-256, is there any workaround to block this using VSE?

Jump to solution

Virustotal.PNG

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 5

Re: VSE Blocking MD5, SHA-1 or SHA-256, is there any workaround to block this using VSE?

Jump to solution

Hi @Fenomeno ,

Yes, You can block the file using just the file name in VSE Access protection rule. But, its important to note that if the name of the malicious file changes, then the rule will be of no use. 

hope this helps.

- Rohit Francis 

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community