Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 553353" data-attributes="member: 32260">Here is a good explanation:&quot;A hash is a series of bytes with a fixed length that uniquely identifies a program or file. A hash value is generated by an algorithm that essentially creates a fingerprint of the file, making it nearly impossible for another program to have the same hash. If you create a hash rule and a user attempts to run a program affected by the rule, the system checks the hash value of the executable file and compares it with the hash value stored in the software restriction policy. If the two match, the policy settings will apply. Therefore, creating a hash rule for an application executable prevents the application from running if the hash value is not correct. Because the hash value is based on the file itself, the file will continue to function if you move it from one location to another. If the executable file is altered in any way, for example, if it is modified or replaced by a worm or virus, the hash rule in the software restriction policy prevents the file from running.&quot;<a href="http://prep-for-70-410.blogspot.com/2015/12/configure-application-restriction.html" target="_blank">http://prep-for-70-410.blogspot.com/2015/12/configure-application-restriction.html</a>File hashes are widely used to uniquely identify files, for example Virus Total shows file hashes in &quot;Additional Information&quot; bookmark.In Windows 10, SRP uses MD5 and SHA-256 cryptographic algorithms to fingerprint the files whitelisted by hash. The second algorithm is pretty good.The main difference (for whitelisting) between Hash and Path checking is simple. The first can recognize if the file has been changed by malware, the second unfortunately cannot.</blockquote>

[QUOTE="Andy Ful, post: 553353, member: 32260"] Here is a good explanation: "A hash is a series of bytes with a fixed length that uniquely identifies a program or file. A hash value is generated by an algorithm that essentially creates a fingerprint of the file, making it nearly impossible for another program to have the same hash. If you create a hash rule and a user attempts to run a program affected by the rule, the system checks the hash value of the executable file and compares it with the hash value stored in the software restriction policy. If the two match, the policy settings will apply. Therefore, creating a hash rule for an application executable prevents the application from running if the hash value is not correct. Because the hash value is based on the file itself, the file will continue to function if you move it from one location to another. If the executable file is altered in any way, for example, if it is modified or replaced by a worm or virus, the hash rule in the software restriction policy prevents the file from running." [URL]http://prep-for-70-410.blogspot.com/2015/12/configure-application-restriction.html[/URL] File hashes are widely used to uniquely identify files, for example Virus Total shows file hashes in "Additional Information" bookmark. In Windows 10, SRP uses MD5 and SHA-256 cryptographic algorithms to fingerprint the files whitelisted by hash. The second algorithm is pretty good. The main difference (for whitelisting) between Hash and Path checking is simple. The first can recognize if the file has been changed by malware, the second unfortunately cannot. [/QUOTE]

Verification