A financial services SOC has confirmed a malicious executable circulating internally. VirusTotal shows the file is not yet detected by most engines, but the SOC has the file's SHA-256 hash. They need Cisco Secure Endpoint to immediately block and quarantine only this exact file on all managed endpoints, without affecting any other files. Which outbreak control mechanism should they configure?