Skip to content

Commit

Permalink
Updated AppControl Manager documents
Browse files Browse the repository at this point in the history
Updated AppControl Manager documents
  • Loading branch information
HotCakeX committed Feb 24, 2025
1 parent 0b98187 commit 16f65e2
Show file tree
Hide file tree
Showing 4 changed files with 41 additions and 35 deletions.
2 changes: 2 additions & 0 deletions Wiki posts/AppControl Manager/Allow New Apps.md
Original file line number Diff line number Diff line change
Expand Up @@ -42,4 +42,6 @@ If something like a power outage occurs during the audit mode phase, on the next

* **Scan Level**: You can choose from different scan levels. [Refer to this page for all the information about them.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Rule-Levels-Comparison-and-Guide)

* **Browse for folders**: Use this button in Step 2 to browse for the installation directories of the app(s) you installed. This will help improve the accuracy of the supplemental policy that will be created. If for some reason you cannot locate the installation directory of the app you installed, ensure you start the app after installation, use it as you normally would so that audit logs will be generated for all of its files and components. These audit logs will then be displayed to you in the `Review the Event Logs` tab.

<br>
8 changes: 4 additions & 4 deletions Wiki posts/AppControl Manager/AppControl Manager.md
Original file line number Diff line number Diff line change
Expand Up @@ -107,9 +107,9 @@ AppControl Manager is engineered with a security-first approach from the ground

* Any file(s) the AppControl Manager ever produces, uses or expects is only from an Administrator-protected location in `C:\Program Files\AppControl Manager`.

* The AppControl Manager supports [process mitigations / Exploit Protections](https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection-reference) such as: `Blocking low integrity images`, `Blocking remote images`, `Blocking untrusted fonts`, `Disabling extension points`, `Export Address Filtering`, `Hardware enforced stack protection`, `Import Address Filtering`, `Validate handle usage`, `Validate stack integrity` and so on.
* The AppControl Manager supports [process mitigations / Exploit Protections](https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection-reference) such as: `Blocking low integrity images`, `Blocking remote images`, `Blocking untrusted fonts`, `Strict Control Flow Guard`, `Disabling extension points`, `Export Address Filtering`, `Hardware enforced stack protection`, `Import Address Filtering`, `Validate handle usage`, `Validate stack integrity`.

* The AppControl Manager always uses the latest .NET and SDK versions, ensuring all the security patches released by Microsoft will be included.
* The AppControl Manager always uses the latest .NET SDK and NuGet package versions, ensuring all the security patches released by Microsoft will be included.

* The entire codebase is thoroughly commented, allowing code reviewers to effortlessly examine and verify every aspect of AppControl Manager's source code.

Expand All @@ -131,13 +131,13 @@ AppControl Manager is engineered with a security-first approach from the ground

### Where Are The Temporary Files Saved To?

The Temporary Files Are Stored in the Following Directory
The temporary files are stored in the following directory

```
C:\Program Files\AppControl Manager\StagingArea
```

Each applicable feature of the AppControl Manager that you start using will generate a uniquely named subdirectory within the StagingArea to store its temporary files (if needed). Upon closing the application, the entire StagingArea directory, along with its contents, will be automatically deleted. These files are utilized by the application for tasks such as creating policies, storing temporary scan results, and other related functions.
Each applicable feature of the AppControl Manager that you start using will generate a uniquely named subdirectory within the `StagingArea` to store its temporary files (if needed). Upon closing the application, the entire StagingArea directory, along with its contents, will be automatically deleted. These files are utilized by the application for tasks such as creating policies, storing temporary scan results, and other related functions.

<br>

Expand Down
43 changes: 35 additions & 8 deletions Wiki posts/AppControl Manager/Deploy App Control Policy.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,26 @@

<br>

Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to select XML policy files or `.cip` binary files to deploy on the system.
Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to select XML policy files or `.cip` binary files to deploy on the local/cloud systems or convert XML files to CIP files for manual deployment.

<br>

## Configuration Details for Unsigned Deployment
> [!IMPORTANT]\
> **Intune Cloud Deployment**
>
> Please [**refer to this page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Upload-App-Control-Policies-To-Intune-Using-AppControl-Manager) for details on how to upload App Control Policies to Intune using AppControl Manager.
* **Select XML Policy File(s)**: Use this button to browse for App Control XML policy files.
<br>

## Configuration Details for Unsigned XML Policy Files Deployment

* **Select CIP Binary File(s)**: Use this button to browse for App Control CIP binary files.
* **Browse**: Use this button to browse for App Control XML policy files that you want to deploy as unsigned policies.

* **Deploy**: Use this button to deploy all of the XML and CIP files you selected on the system.
* **Deploy**: Use this button to deploy all of the XML files you selected on the local or cloud system.

<br>

## Configuration Details for Signed Deployment
## Configuration Details for Signed XML Policy Files Deployment

<div align="center">

Expand All @@ -36,6 +41,14 @@ Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Securit

<br>

* **Browse**: Use this button to browse for App Control XML policy files that you want to Sign and deploy.

* **Deploy**: Use this button to deploy all of the XML files you selected on the local or cloud system.

* **Sign Only - No Deployment**: If you only want to sign the policy without deploying it, you can use this button. It will generate the signed CIP file for you that you can use to manually deploy somewhere else.

<br>

When signing and deploying App Control Policies, a dialog will be displayed asking for additional information required for signing the policy.

* **Certificate File**: Provide the path to the certificate `.cer` file. It must be a code signing certificate that is either issued by a public certificate authority (CA) or a self-signed certificate. You can generate a self-signed certificate suitable for App Control policy signing in [the certificate building page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Build-New-Certificate) of the AppControl Manager. The certificate's details will be added to the XML policy as signers. The certificate must exist in the Personal store of the Current User certificate stores with private key.
Expand All @@ -50,8 +63,22 @@ All of the information you submit will be saved in app settings so that the next

<br>

## Intune Cloud Deployment
## Configuration Details for CIP Binary Files Deployment

This section can deploy `.CIP` binary files on the local or cloud system, whether they are signed or unsigned.

* **Browse**: Use this button to browse for App Control `CIP` binary files that you want to deploy.

* **Deploy**: Use this button to deploy all of the CIP files you selected on the local or cloud system.

<br>

## Configuration Details for Converting XML to CIP Files

Use this section to convert all of your XML files to CIP binaries files in bulk.

* **Browse**: Use this button to browse for App Control XML policy files that you want to convert to `CIP` binary files.

Please [**refer to this page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Upload-App-Control-Policies-To-Intune-Using-AppControl-Manager) for details on how to upload App Control Policies to Intune using AppControl Manager.
* **Convert**: Use this button to convert all of the selected XML policy files to `CIP` binary files with the same file names.

<br>
23 changes: 0 additions & 23 deletions Wiki posts/WDACConfig Module Main/WDACConfig.md

This file was deleted.

0 comments on commit 16f65e2

Please sign in to comment.