Blocked hashes
|
EDR rules, exclusions, and blocked hashes can now be managed directly from ESET PROTECT. These features will be released gradually throughout October 2026. Feature availability depends on your environment. |
The Blocked hashes section contains a list of hashes used to block matching executables across devices managed by ESET PROTECT. You can add blocked hashes manually or through several response actions in ESET PROTECT.
|
A blocked hash can be added in the following ways: •Manually, by clicking the Add hashes button. See Add hashes to block below. •Automatically, when an XDR rule with the Block hash or Block and quarantine hash response action is triggered. •As a response to an incident, by selecting Block hash or Block and quarantine hash. •During an Advanced Search investigation, from the Indicator details or Executable details page. |
ESET PROTECT supports SHA-1 and SHA-256 hashes, allowing organizations to block malicious executables after they are detected or proactively by using hashes from an indicator of compromise feed.
When an attempt is made to run an executable with a blocked hash, ESET PROTECT reports it as a security incident in Advanced Search under the Blocked files threat category.
Blocked hashes views
The Blocked hashes table provides two views, depending on the level of detail you need. For MSP administrators, both views also support displaying data separately for each customer.
Hashes (Overview)
This is the default view. It displays one row for each hash. If the same hash was blocked through multiple entry points, the information from the individual block entries is combined into one row.
Use this view to get a quick overview of the hashes that are currently blocked.
All entries
This view displays a separate row for each block entry. If the same hash was blocked more than once, for example, manually, by a response action, or by an XDR rule, each block entry appears on a separate row.
Use this view to audit or troubleshoot blocking activity, including when and how a specific block entry was created.
Show data per customer
For MSP administrators, the Show data per customer action is available in both the Hashes (Overview) and All entries views.
It displays a separate row for each customer for whom the selected hash is blocked, either across the customer’s entire environment or for specific groups or computers. Because file metadata and block details can differ between customers, each row displays the information specific to that customer.
|
Mixed values A column displays Mixed when the entries grouped into a single row contain different values for that column. This can occur when individual block entries or customer-specific records have different values. Open the detailed view to see the value for each individual entry. |
The Blocked hashes section allows you to manage the list of blocked hashes. Select a hash and click the Actions button, or click a hash to:
•
View details—View the executable details.
•
Show data per customer—View data for individual customers. This option is available only for managed customers.
•
Manage targets—Add or remove the computers or groups on which matching executables are blocked.
•Unblock hash—Remove the block for the selected hash and allow matching executables to run on the applicable targets. You can select all blocked hashes by selecting the check box next to the Name column header, or you can select individual blocked hashes by selecting the corresponding check box.
•
Send to quarantine—Quarantine the executable matching the selected hash on the endpoint. This action is available only when a blocked hash is selected. You can select all blocked hashes by selecting the check box next to the Name column header, or you can select individual blocked hashes by selecting the corresponding check box.
•Edit comments—Edit the comment associated with the hash.
•
Advanced search—Open the Advanced search section, applying the selected hash as a filter.
•
Access Group > Move—Move the object to another Static Group where it is available to users with sufficient rights for the target group. Changing the Access Group is useful when solving access issues with other users. Access Group sets the object's Static Group and access to the object based on the user's access rights.
|
Do not the Block or Kill action on Windows system processes or executables, such as svchost.exe. This may cause an operating system crash. |
Filters and layout customization
You can customize the current Web Console screen view:
•Manage the side panel and main table.
•Add filters and filter presets. You can use tags for filtering the displayed items.
Add hashes to block
1.Click the Add hashes button.
2.Hashes—Add SHA-1 and SHA-256 hashes to block matching executables across devices and groups in your network.
3.Type a comment to apply it to all added hashes.
4.Select a response action: Block executables—to block matching executables, or Block and quarantine executables—to block and quarantine matching executables. Click Continue.
5.Targets—Click Manage targets to select the computers or groups on which you want to block matching executables and click OK. Click Continue.
6.Review—Review the data in the list and select the hashes you want to block. Click Continue.
7.Summary—Review the summary and click Block.