---
title: Malicious hash identified by Threat Intel
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Malicious hash identified by Threat
  Intel
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Malicious hash identified by Threat Intel

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0002-execution](https://attack.mitre.org/tactics/TA0002)Technique:[T1204-user-execution](https://attack.mitre.org/techniques/T1204) 
## Goal{% #goal %}

Detect a file on disk whose SHA256 hash has been identified as malicious or suspicious by threat intelligence.

## Strategy{% #strategy %}

This rule monitors file activity events (OCSF class `2004`) that include a file hash and checks whether that hash was enriched by threat intelligence with a `malicious` or `suspicious` intention and a `SHA256` reputation match. A hash match against known malicious threat intel indicates the file itself is a known malicious artifact, regardless of which host or platform it was observed on.

## Triage and response{% #triage-and-response %}

- Identify the affected host and the full file path associated with the flagged hash `{{@ocsf.evidences.file.hashes.value}}`.
- Review the threat intel source and context for the hash match to understand the associated malware family or campaign, if known.
- Determine how the file arrived on the host (download, email attachment, removable media, lateral transfer) by reviewing surrounding process and file activity.
- Check whether the file was executed, and if so, investigate downstream process activity for signs of compromise.
- Isolate the affected host if execution or further spread is suspected, and collect the file for forensic analysis before removal.
- Search for the same hash across other hosts in the environment to determine the scope of exposure.