Carbon Black Cloud: Why are MD5 Hash Values Included in Some Event Data?
book
Article ID: 291232
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Why are MD5 hash values included in Event and Alert data in the Console when the policy option "Hash MD5" is unchecked?
Environment
Carbon Black Cloud Console: All Versions
Carbon Black Cloud Endpoint Standard Sensor: All Supported Versions
Carbon Black Cloud Enterprise EDR Sensor: All Supported Versions
Resolution
Customers with Enterprise EDR will always hash MD5.
Customers with Endpoint Standard + Enterprise EDR will see that MD5s are hashed even with the policy setting unchecked.
Customers with Endpoint Standard only should not see MD5 hashes when this option is unselected if seen please reach out.
Additional Information
The Hash MD5 option will prevent the Sensor from calculating MD5 hashes when the calculation will affect a process at startup; otherwise, MD5 hashes will still be calculated.
The Hash MD5 option will not affect hash calculations that occur after a process has started and the Sensor has performed initial reputation look ups
For environments with Endpoint Standard and Enterprise EDR, Enterprise EDR data will always generate the MD5 hash regardless of the policy settings