# Elastic endpoint security blocklist process delete the binary file **URL:** \ **Category:** Endpoint Security\ **Created:** [December 9, 2022, 9:33am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868 "2022-12-09T09:33:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [December 9, 2022, 9:33am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/1 "2022-12-09T09:33:05Z")
Hi all I have a case using the elastic endpoint. I tried using the blocklist in elastic endpoint to block the process /bin/ls. After the policy got installed the binary file in /bin/ls disaprear and i cannot execute ls anymore How did that happen can anyone tell me. and how elastic endpoint block a process from being execute? Thanks for your time. ---
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [December 9, 2022, 9:50am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/2 "2022-12-09T09:50:49Z")
Second try at the blocklist and the first time i tried to execute the command i got the `opeartion not permitted` and then for the second time i exec the command i get the `no such file or dirtectory` It seems that the endpoint has delele the binary completely and even when i delele the blocklist it did not return. ---
**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\ **Post date:** [December 9, 2022, 9:57am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/3 "2022-12-09T09:57:38Z")
Hi Lusandya, Endpoint quarantined the file , You have to add endpoint exception to get it back. ---
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [December 9, 2022, 10:00am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/4 "2022-12-09T10:00:30Z")
Oh So can i ask how to add endpoint exception and where did endpoint put the binary file in? ---
**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\ **Post date:** [December 9, 2022, 10:01am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/5 "2022-12-09T10:01:10Z")
Did you get any alert when you tried to run the process for first time? ---
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [December 9, 2022, 10:05am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/6 "2022-12-09T10:05:43Z")
I didn't get any alert on the server that i run the binary only the `bash: /bin/ls: Operation not permitted` ---
**Author:** ![Venkata\_Raja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/venkata_raja/32/114264_2.png) [@Venkata\_Raja](https://discuss.elastic.co/u/Venkata_Raja)\ **Post date:** [December 9, 2022, 10:19am UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/7 "2022-12-09T10:19:18Z")
Follow [Rule exceptions and value lists | Elastic Security Solution [8.5] | Elastic](https://www.elastic.co/guide/en/security/8.5/detections-ui-exceptions.html#endpoint-rule-exceptions) To see how to add endpoint exception , when endpoint detected a malware process and quarantined it. ---
**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Post date:** [December 10, 2022, 4:00pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/8 "2022-12-10T16:00:06Z")
I have new information regarding this case. Its not that when the binary got add to the blocklist that endpoint delete the file. It is after i remove the blocklist from the policy that the endpoint delete the file from my machine. Do you know why that is the case? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 7, 2023, 4:00pm UTC](https://discuss.elastic.co/t/elastic-endpoint-security-blocklist-process-delete-the-binary-file/320868/9 "2023-01-07T16:00:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.