topic Malicious Hash detected as Adminstrative Hash exception in Cortex XDR Discussions

Malicious Hash detected as Adminstrative Hash exception

dasarath_s — Fri, 11 Oct 2024 07:07:35 GMT

Hi Team,

On analysing an ransomware incident, i have block the hash of malicious file and added the file path of malicious file into IOCs. However i can see the alerts for malicious hash in the Critical alert (IOCs based) and Low alert - Administrative Hash Exception.

I have check allow list of IOCs and global exeception, but there was no exception for the malicious Hash.

Re: Malicious Hash detected as Adminstrative Hash exception

jmazzeo — Mon, 21 Oct 2024 14:55:59 GMT

Hi @dasarath_s, thanks for reaching us using the Live Community.

Please in the console go to Incident Response - Response - Block List and look there for the hash.

The hashes added to the "Block List" will be blocked, the ones added to the IOC list will be detected only.

If this post answers your question, please mark it as the solution.