Add hash values to the block list

You can add MD5 hash values of files that you want to be treated as malicious when found in HTTP and SMTP downloads. If a file's hash matches a hash value in the block list, the Sensor treats the file as malicious of very high severity.

1. Select Policy → <Admin Domain Name> → Intrusion Prevention → Exceptions → File Hashes.
   On the Blocked Hashes tab, you can add the hash values to be blocked, manage the file types to be checked for the blocked hashes, and view the maximum file size scanned.

   
   
   

   The following table describes the details displayed on the Blocked Hashes tab.

   Format	Description
   File Hash	Specifies the file hash. The File Hash will be in the MD5 format.
   File Name	Specifies the name of the file along with the file extension
   Last Updated	Displays the following: Time: Specifies the time stamp of the imported block list file hash By: Specifies the user who imported the block list file hash
   Comment	Any comments about the list

2. Select Other Actions → Import to import a file containing the hash values.
3. Click Browse to locate the CSV file that contains the list of hashes you want to import.
4. Click Import.

   The file to be imported should be in the following CSV format.

   <Name of the file with extension (like .exe, .com)>,<File size>,<Hash type>,<File hash>,<Description>

   Example file format: Application.exe, 1024000, MD5, 30a4edd18db6dd6aaa20e3da93c5f425, textual description. Also note that if you are importing multiple files, each file has to be in a new line.

   The following is a sample for a CSV file with multiple file hashes.

   
   
   

   The following table describes the details of the files to be imported in the CSV or XML format.

   Format	Description
   <Name of the file with extension (like .exe, .com)>	Specifies the name of the file to be imported, along with the file extension. This is an optional value.
   <File size>	Specifies the size of the file to be imported. The file size should be a valid integer. Note File size value is mandatory. It is used by the Sensor as a secondary matching criterion when the same hash has been added to both the block list and allow list. Note If the file size is unknown, you can add a placeholder value like 1 to the CSV file as this value is mandatory.
   <Hash type>	Specifies the format of the hash. The supported file hash type is the MD5 format.
   <File hash>	Specifies the hash for the file to be imported
   <Description>	Specifies the description of the file to be imported. This is an optional value.

   Note

   If you are importing using CSV, you can import the same file hash to both allow list and block list.

5. To add a single file hash to the blocked hashes, click .
   Click Save after entering the values in File Hash, File Name, and Comment. The Comment field is optional.

   Note

   The File Hash should be a 32 digit hexadecimal value.

   
   
   

6. To export the blocked hashes from the Manager to a local system, click Other Actions → Export All.
7. To delete specific entries from the block list, select them by holding the Shift or Ctrl key and clicking on the required rows. Then click .
   The deleted hashes are now neither in the allow list nor in the block list.
8. To remove all the entries, select Other Actions → Delete All.
9. To move specific entries to the allow list, select the entries and then select Other Actions → Move to Allow List.
   • A manual signature set push is not required each time the allow list or the block list is updated. The Manager updates the Sensor dynamically with the modified entries in the allow list or block list, at an interval of 5 minutes. These updates occur in bulk (the complete list of entries) or increments (added/deleted entries). To view the status of these updates, use the show ab stats command. For more information, see the CLI commands section in the Trellix Intrusion Prevention System Product Guide.
   • You can configure a maximum of 99,000 entries (allowed and blocked).