Malicious Hash detected as Adminstrative Hash exception

[dasarath_s]

Hi Team, 

On analysing an ransomware incident, i have block the hash of malicious file and added the file path of malicious file into IOCs. However i can see the alerts for malicious hash in the Critical alert (IOCs based) and Low alert - Administrative Hash Exception. 

I have check allow list of IOCs and global exeception, but there was no exception for the malicious Hash.

[jmazzeo]

Hi @dasarath_s, thanks for reaching us using the Live Community.

Please in the console go to Incident Response - Response - Block List and look there for the hash.

The hashes added to the "Block List" will be blocked, the ones added to the IOC list will be detected only.

If this post answers your question, please mark it as the solution.