Currently managing Custom Indicators is a PITA - when a vendor drops an update and it gets blocked by Exploit Guard, we always end up doing something hacky like adding a process exclusion with wildcards.

This is somewhat undesirable security-wise and it would be better if we had a way to exclude by File Hash / Certificate similar to the way the Microsoft Security Portal handles it.

Better still if it could be handled by Agent, Client or Account the way current exclusions are handled.