---
title: "Executable page"
slug: "executable-page-1"
tags: ["Reference", "ENS 10.7.x"]
updated: 2026-10-06T19:45:35Z
published: 2026-10-06T19:45:35Z
canonical: "docs.trellix.com/executable-page-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Executable page

Add or edit an executable in an Application Protection rule.

 
 
 

When configuring executables, consider the following:

 
 

- You must specify at least one identifier: 
 **File name or path**, 
 **MD5 hash**, or 
 **Signer**.
- If you specify more than one identifier, all identifiers apply.
- If you specify more than one identifier and they don't match, the executable definition is invalid. For example, the file name and MD5 hash don't apply to the same file.

 
 
 
 
 

| Section | Option | Definition |
| --- | --- | --- |
| **Properties** | **Name** | Specifies the process name. This field is required with at least one other field: **File name or path**, **MD5 hash**, or **Signer**. |
| **File name or path** | Specifies the file name or path of the executable to add or edit. |
| **MD5 hash** | Indicates the MD5 hash (32-digit hexadecimal number) of the process. |
| **Signer** | **Enable digital signature check** — Guarantees that code hasn't been changed or corrupted since it was signed with cryptographic hash. If enabled, specify: - **Allow any signature** — Allows files signed by any process signer. - **Signed by** — Allows only files signed by the specified process signer. A signer distinguished name (SDN) for the executable is required and it must match exactly the entries in the accompanying field, including commas and spaces. The process signer appears in the correct format in the events in the log files. For example: <samp> C=US, ST=WASHINGTON, L=REDMOND, O=MICROSOFT CORPORATION, OU=MOPR, CN=MICROSOFT WINDOWS</samp> > [!NOTE] > Note > > You can enter > > <samp>S</samp> > > for the state or ProvinceName object identifier, but the element automatically appears as > > <samp>ST</samp> > > in the log files. From Trellix ePO - On-prem **Event Log**, copy and paste the details from the **Source Signer Process** field from an Trellix ENS event. |
| **Notes** |  | Provides more information about the item. |