Implement Endpoint Indicators If you have Microsoft Defender for Endpoint, you can create a custom indicator to block the file from being executed on managed devices. Navigate to: Settings > Endpoints > Indicators > File hashes. Action: Add the SHA256 hash and set the response action to Block and Remediate. This will stop the file from running and attempt to remove it if found on a device. Reference: https://learn.microsoft.com/en-us/defender-endpoint/indicator-file