Environment
- App Control Console: All Versions
- App Control Agent: All Versions
Objective
How to block an executable file from running if it has been moved and/or renamed from the expected directory?
Resolution
Create a File Hash Ban rule in the console: Rules > Software rules > Files > Add File Rule:
Rule Name: <Give it a Name>
Rule Type: Ban
Type: Hash
Hash: <Paste either the Sha256/Sha1/MD5 hash values>
Policies: All or Specify Selected polices
Additional Notes
Please check the user guide for more information on File Hash Ban rules
https://docs.vmware.com/en/VMware-Carbon-Black-App-Control/index.html