Help CenterOverview
Note: Requires ThreatLocker Windows Agent Version 10.3 or greater.
The first few bytes of a file are called "magic bytes" and they tell the operating system if a file is executable, disregarding the file's named extension (such as "jpg", "exe", etc.).
Attackers can manipulate executable files, renaming them with non-executable file extensions, such as taking a file named 'malware.exe' and changing it to 'invoice.pdf', which can trick systems and users.
The Option "EnableHexCode" can be enabled in ThreatLocker to allow the ThreatLocker Agent to use the hex code of a file to determine what type of file it is. See the associated article here for more information on enabling Options.
Warnings
Enabling this Option may lead to additional denies. If you are going to enable this option, it is highly recommended to either be in Learning Mode or slowly roll out the deployment. You can enable this Option at a single computer or group level for initial testing before deploying across the organization.