Blocking suspected malware by file hash indicators in Defender for Endpoint — only PE files are supported

SC-200 By islever Editorial Last updated

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Short answer

A Defender for Endpoint file hash indicators support portable executable (PE) files only, so only the .sys file can be blocked.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender for Endpoint Plan 2 and contains 500 Windows devices. As part of an incident investigation, you identify the following suspected malware files: • sys • pdf • docx • xlsx You need to create indicator hashes to block users from downloading the files to the devices. Which files can you block by using the indicator hashes?
  1. File1.sys only Correct Answer
  2. File1.sys and File3.docx only
  3. File1.sys, File3.docx, and File4.xlsx only
  4. File2.pdf, File3.docx, and File4.xlsx only
  5. File1.sys, File2.pdf, File3.docx, and File4.xlsx

Key Takeaways

Defender for Endpoint file indicators work only on portable executable (PE) files; .sys (a driver PE file) can be blocked, whereas .pdf, .docx, and .xlsx are not PE files and cannot be blocked by file hash indicators.

You must block suspected malware files (.sys, .pdf, .docx, .xlsx) by hash in Defender for Endpoint Plan 2; file hash indicators support portable executable (PE) files such as .exe, .dll, and .sys only.

Common mistake: Assuming any file type can be blocked by its hash — the indicator mechanism is limited to PE files, so only the .sys file among the listed candidates qualifies.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Endpoint file indicators (IOC hashes) support portable executable (PE) files, including.exe,.dll, and.sys files only. Among the four listed files, File1.sys is the only PE file, so it is the only one that can be blocked by a file hash indicator.

Why the Other Options Are Wrong

The.pdf,.docx, and.xlsx files are not PE files, so none of them can be blocked through the file hash indicator mechanism, which rules out options B, C, D, and E. Choosing any option that includes non-PE files rests on the incorrect belief that any file type can be blocked by hash.

Community Comment Notes

The community leans E (block all four, 59 votes), but the more documented answers cite https://learn.microsoft.com/en-us/defender-endpoint/indicator-file, which states file indicators support PE files only. Hawklx, talosDevbot, and 1375514 all confirm only PE files (.exe/.dll/.sys) are supported, making File1.sys the sole blockable file.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/indicator-file

This link opens the official vendor documentation in a new tab.

Community Votes

E
59%
A
41%

59% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. liveup2it 👍 17 Answered E
    Based on File hashes, you should be able to block each and every file with this hash, regardless the name of the file.
  2. g_man_rap 👍 5 Answered A
    Key Points: Executable Files: Microsoft Defender for Endpoint can block executable files such as .exe, .dll, .sys, and other similar types. Non-Executable Files: Generally, Microsoft Defender for Endpoint does not allow blocking of non-executable files (e.g., .pdf, .docx, .xlsx) by file hash using the same indicator mechanism designed for executables.
  3. Hawklx 👍 5 Answered A
    This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including .exe and .dll files. Ref: https://learn.microsoft.com/en-us/defender-endpoint/indicator-file
  4. phoenix5 👍 3
    Answer - C (.sys , .docx, .xlsx as per this explanation by Copilot - You can create indicator hashes to block executable files with the following extensions: .exe, .dll, and .sys. Additionally, Office files like .docx and .xlsx can also be blocked using indicator hashes. However, PDF files cannot be blocked using indicator hashes in Microsoft Defender for Endpoint1.
  5. talosDevbot 👍 3 Answered A
    File indicators only support Portable Execution (PE) files like exe, dll, sys
Show 8 more comments
  1. 1375514 👍 2 Answered A
    https://learn.microsoft.com/en-us/defender-endpoint/indicator-file From Microsoft: "File indicators support portable executable (PE) files, including .exe and .dll files only." Only the .sys is a PE file, therefore it is the only file that can be blocked via file indicator.
  2. b9cf0e5 👍 2
    Answer is D: Blocking .sys files could affect system functionality, and thus Defender for Endpoint does not allow blocking system-critical files.
  3. Avaris 👍 1 Answered E
    I am gonna go with a whim and select E for one reason, I remember blocking all types of files including pdfs we block with hashes I think
  4. Rodwhite 👍 1 Answered E
    I took the hash from (.pdf, sys, doc,) and each file and was able to upload successfully. Therefore, the answer is E.
  5. arturro007 👍 1 Answered E
    Question is about hashes. You can add any hash to Defender and it will be blocked.
  6. smanzana 👍 1
    E https://learn.microsoft.com/en-us/defender-endpoint/indicator-file
  7. RonWonkers 👍 1 Answered E
    You make get a hash for every file and block it.
  8. ada26b1 👍 1 Answered E
    Surely you can block all of them

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide