EDR: Can you search for processes using SHA256 hashes?
search cancel

EDR: Can you search for processes using SHA256 hashes?

book

Article ID: 289187

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Can processes be searched for using SHA256 hashes instead of MD5?

Environment

  • EDR Server: 6.3.0 and high
  • EDR Sensor: 6.2.1 and Higher

Resolution

Yes.  If the EDR Server is on release v6.3.0 or higher and EDR sensor is on release v6.2.1 or higher SHA256 processes can be searched for by SHA256 hash.