diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts
index 0a63ac042a6e6..ea7fd09b0888f 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts
@@ -206,6 +206,25 @@ describe('mapping', () => {
         })
       );
     });
+
+    it('should lowercase hash condition value', function () {
+      testMapping(
+        {
+          name: 'MD5 trusted app',
+          description: 'MD5 Trusted App',
+          os: 'linux',
+          entries: [
+            createConditionEntry(ConditionEntryField.HASH, '1234234659Af249ddf3e40864E9FB241'),
+          ],
+        },
+        createExceptionListItemOptions({
+          name: 'MD5 trusted app',
+          description: 'MD5 Trusted App',
+          osTypes: ['linux'],
+          entries: [createEntryMatch('process.hash.md5', '1234234659af249ddf3e40864e9fb241')],
+        })
+      );
+    });
   });
 
   describe('exceptionListItemToTrustedApp', () => {