If you have the hashes you could create a custom alert against Endpoint Activity → Process Start Events
Note this example is for a linux machine but we can see the nested JSON contains the sha256
An example query for this machine and 2 hashes would be
where(eu-west-1.compute.internal process.exe_file.hashes.sha256 IN ["d45d0317aeee450fc40b9134457c842eec25bf147b9f90528f3f715b20697613","7bcbf925e9c76b97654810d1887351baf026144e09183fc08e64822fcc417b5a"])
David