User guide
Malware detection (file-hash)
How QuickZTNA detects malicious files on endpoints using SHA-256 hash reputation, what it records, how quarantine enforcement works, and what it deliberately does not do.
Last updated August 30, 2026
Table of contents
QuickZTNA’s endpoint agent performs file-hash malware detection. It computes SHA-256 hashes of executable files and checks them against a malware-hash feed and VirusTotal; confirmed-malicious hits are recorded and can quarantine the device.
What this page used to describe. Earlier versions documented filesystem scanning of Downloads, Documents, Desktop and
/tmpfor credit cards, SSNs, API keys and private keys, with match redaction. That capability was removed in the 2026 lean pivot. Only the malware path remains. Nothing on this page requires file contents to leave the device.
How it works
- The agent hashes executable files it encounters and reports the SHA-256 digests, with file name and path.
- The server checks each hash against the malware-hash feed and VirusTotal reputation data.
- A confirmed-malicious hash produces a detection record and an audit event.
- In enforce mode, the device is quarantined — dropped from the mesh until an admin clears it. In detect mode, the event is recorded and access is unchanged.
What is and is not collected
| Collected | Not collected |
|---|---|
| SHA-256 file hash | File contents — never uploaded |
| File name and path | Document text, clipboard, or keystrokes |
| Detection verdict and timestamp | Screen captures or session recordings — never captured |
Retention follows the standard audit retention of 90 days. See the privacy policy for the full data-collection disclosure.
Configuration
Malware detection is configured per organization from the dashboard. Choose detect or enforce mode, and optionally register a webhook so detections are forwarded to your SIEM as they happen.
Limits — stated plainly
- Hash reputation only. There is no heuristic, behavioural, or sandbox analysis. A brand-new malicious binary with no reputation will not be flagged.
- Not an EDR. This complements an endpoint protection product; it does not replace one.
- No content inspection. By design — see the note above.
Next
- Device posture — the compliance gate that pairs with quarantine.
- Observability — where detections land in audit and SIEM export.
Frequently asked questions
- Does QuickZTNA scan file contents for PII or secrets?
- No. Content scanning for credit cards, SSNs, API keys and private keys was removed in the 2026 lean pivot. The agent reports SHA-256 file hashes only — file contents never leave the device. If you need content-inspection DLP, keep a dedicated tool such as Purview or Forcepoint.
- What happens when a malicious file is found?
- The detection is recorded with the file hash, name and path, and raised as an audit event that can be forwarded to your SIEM via webhook. In enforce mode the device is quarantined — removed from the mesh until an admin clears it. In detect mode the event is recorded without changing access.