Does Symantec have coverage for a specific hash

book

Article ID: 196959

calendar_today

Updated On:

Products

Endpoint Protection Endpoint Security

Issue/Introduction

You want to know whether or not Symantec has coverage for a specific file hash or multiple file hashes.

Resolution

To verify coverage, hashes must be submitted to the self-service portal at https://symsubmit.symantec.com.  A support case does not need to be opened.  Follow the steps below to verify coverage using the self-service portal.

  1. Visit https://symsubmit.symantec.com.
  2. Select the Not Detected by Symantec tab.
  3. Change the Submission Type to Provide an MD5 or SHA-256 hash of a file.
  4. Enter the hash in the File Hash field.
  5. Complete the Your Details section and click Submit.

When the submission review completes you'll receive an email that contains coverage details.

 

FAQ

Q: Can I open a support case to verify hash coverage?
A: No.  Use the steps above to verify hash coverage.  Support cases opened asking only to verify hash coverage will instruct you to follow the submission process above and then be closed.  

Q: Are there any other methods to submit hashes to Symantec for review?
A: Contact your Symantec account manager about additional services available.

Q: How can I use my Symantec security product to block a hash?
A: Symantec Endpoint Protection and Symantec Endpoint Security can be used to block files by hash.  

Q: What if I have additional questions beyond coverage of a specific file?
A: If you have additional questions about a submission you can open a support case after the file has been submitted.  Please include the submission number and the additional questions when opening a support case.

Q: Are there any other methods to verify hash coverage?
A: VirusTotal has a hash submission page. https://www.virustotal.com/gui/home/search.  There is also an API to automate submissions https://developers.virustotal.com/v3.0/reference#overview.