Block malware filehash values using applocker

Question

Hi All, is there a way we can block malware filehash values using Applocker GPO without having to locate or have a actual copy of the malware file ? appreciate your response... cheers..&nbsp;

ericstarker · Answer

hari-siva&nbsp;
Hello! You've posted your question in the&nbsp;Tech Community Discussion space, which is intended for discussion around the Tech Community website itself, not product questions. I'm moving your question to the&nbsp;Windows security space- please post Windows security questions here in the future.
&nbsp;
(If I am incorrect on the topic you are asking about, please let me know.)&nbsp;

deleted · Answer

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo
Hello , I think the malware mechanisms are working not visible
and group rules will not be effective!

hari-siva · Answer

thanks Andrzej1 , let me check it and advise..

reza_ameri · Answer

AppLocker is NOT a replacement for Anti-Malware product and to set a policy, you will need to have a sample of it.
However, you may do it other way, like create a whitelist and only add trusted applications and place the rest into black list, so it will block everything else.
In case it is a malware, you may report it to Microsoft Anti-Malware team to create a signature. You may upload it to websites where they product hash key.

hari-siva · Answer

thanks Eric.

Forum Discussion

Block malware filehash values using applocker

8 Replies