locked
How to block a file from being run or downloaded in ATP? RRS feed

  • Question

  • How to block a file from being run or downloaded in ATP?

    We know the file name but not the hash, Everything file stopping a file from being run says we need the hash.  How do you get the hash for a file you don't have?

    Thanks!

    Friday, August 7, 2020 1:09 PM

All replies

  • How do you get the hash for a file you don't have?

    I can answer this bit using PowerShell.

    Get-FileHash -Path 'C:\temp\FileDownloaded.txt'

    By default you will have SHA256 hash value. You could change the algorithm like this below

    Get-FileHash -Path 'C:\temp\FileDownloaded.txt' -Algorithm MD5
    

    for more info about the Get-FileHash

    Get-Help Get-FileHash

    Hope this helps.

    Friday, August 7, 2020 3:18 PM
  • But what if we don't have the file?  But want to block any file with that name from being ran or downloaded?

    Friday, August 7, 2020 4:22 PM