App Control: How to block a file that has been renamed or moved from executing

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to block an executable file from running if it has been moved and/or renamed from the expected directory?

Environment

• App Control Console: All Versions
• App Control Agent: All Versions

Resolution

Create a File Hash Ban rule in the console: Rules > Software rules > Files  > Add File Rule:

Rule Name: <Give it a Name>
Rule Type: Ban
Type: Hash
Hash: <Paste either the Sha256/Sha1/MD5 hash values>
Policies: All or Specify Selected polices

Additional Information

Please check the user guide for more information on File Hash Ban rules

https://docs.vmware.com/en/VMware-Carbon-Black-App-Control/index.html