Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: How to block a file that has been renamed or moved from executing

App Control: How to block a file that has been renamed or moved from executing

Environment

  • App Control Console: All Versions
  • App Control Agent: All Versions

Objective

How to block an executable file from running if it has been moved and/or renamed from the expected directory?

Resolution


Create a File Hash Ban rule in the console: Rules > Software rules > Files  > Add File Rule:
Rule Name: <Give it a Name>
Rule Type: Ban
Type: Hash
Hash: <Paste either the Sha256/Sha1/MD5 hash values>
Policies: All or Specify Selected polices

Additional Notes

Please check the user guide for more information on File Hash Ban rules
https://docs.vmware.com/en/VMware-Carbon-Black-App-Control/index.html

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎12-26-2018
Views:
720
Contributors