02-03-2026 09:02 AM
Hello @tlmarques ,
Greetings for the day.
Yes, it is possible to block older versions of Notepad++ while allowing only version 8.9.1, but this must be achieved through SHA256 hashes rather than a simple version number toggle, as Cortex XDR does not natively support blocking based solely on application version strings.
To allow only version 8.9.1 and block all other versions (installation and execution), you should use a combination of Restriction Profiles and Hash Control.
Identify the SHA256 hashes for the Notepad++ version 8.9.1 executable (notepad++.exe) and its specific installer (for example, npp.8.9.1.Installer.x64.exe).
The global Block List supports Windows PE, PE64, and DLL files, which includes the standard Notepad++ binaries.
Instead of manually adding large numbers of older hashes to a global block list, use a Restriction Profile to block the application by filename and then create an exception for your allowed version.
Navigate to Policy > Prevention Profiles > Restrictions
Create a new profile and add notepad++.exe and npp.*.Installer*.exe to the Executables block list
This blocks the execution of any file with these names regardless of version.
Explicitly allow the hash of version 8.9.1 so it overrides the restriction.
Navigate to Policy > Prevention and select the policy group for your endpoints
Go to the Exceptions tab and add a Disable Prevention Rule
Configure the rule to target the SHA256 hash of the 8.9.1 executable and installer
Alternatively, you can use Malware Profile > Allow List to add the 8.9.1 hash.
If you have specific older versions you want to ensure are blocked even if renamed:
Navigate to Response > Action Center > New Action > Add to Block List
Enter the SHA256 hashes of the older Notepad++ versions
Warning: Hashes added to the global Block List are enforced universally across all endpoints in the tenant and take precedence over most other policy rules.
MSI Installers: Cortex XDR’s Hash Block List in the Action Center does not currently support blocking .msi files by SHA256 hash. If the Notepad++ versions are distributed as .msi packages, the hash-based block will not trigger. You must rely on filename or path restrictions in a Restriction Profile for these files.
Size Limits: For agent versions 8.1 and below, there is a 100 MB limit for hash calculations; files exceeding this size will not be matched against the block list. Most Notepad++ binaries are well under this limit.
You can verify whether the block and allow lists are correctly applied to a local Windows endpoint by running the following command in an Administrator command prompt:
"%ProgramFiles%\Palo Alto Networks\Traps\cytool.exe" persist print hash_overrides.db
If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".
Thanks & Regards,
S. Subashkar Sekar
