diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/Application Control WDAC Frequently Asked Questions FAQs.md b/Wiki posts/App Control for Business/Application Control WDAC Frequently Asked Questions FAQs.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/Application Control WDAC Frequently Asked Questions FAQs.md rename to Wiki posts/App Control for Business/Application Control WDAC Frequently Asked Questions FAQs.md diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/EKUs in WDAC, App Control for Business, Policies.md b/Wiki posts/App Control for Business/EKUs in WDAC, App Control for Business, Policies.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/EKUs in WDAC, App Control for Business, Policies.md rename to Wiki posts/App Control for Business/EKUs in WDAC, App Control for Business, Policies.md diff --git a/Wiki posts/App Control for Business/Fast and Automatic Microsoft Recommended Driver Block Rules updates.md b/Wiki posts/App Control for Business/Fast and Automatic Microsoft Recommended Driver Block Rules updates.md new file mode 100644 index 000000000..42e67a095 --- /dev/null +++ b/Wiki posts/App Control for Business/Fast and Automatic Microsoft Recommended Driver Block Rules updates.md @@ -0,0 +1,26 @@ +# Fast and Automatic Microsoft Recommended Driver Block Rules updates + +
+ +[The blocklist is updated with each new major release of Windows, typically 1-2 times per year](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules), but you can deploy the recommended driver block rules policy more frequently. + +[This is the GitHub source](https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md) for the XML content shown on the Microsoft document website. You can see when the last time it was changed was, read the change history and commit messages. + +Use the [**AppControl Manager**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to **automate** the required [steps explained on the document](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules#steps-to-download-and-apply-the-vulnerable-driver-blocklist-binary) to download and deploy the recommended driver block rules. + +
+ +![image](https://raw.githubusercontent.com/HotCakeX/.github/refs/heads/main/Pictures/APNGs/Fast%20and%20Automatic%20Microsoft%20Recommended%20Driver%20Block%20Rules%20updates.apng) + +
+ +The **Auto Update** button in [**the Create Policy page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-App-Control-Policy) creates a scheduled task in Windows that will **automatically** run every 7 days to keep the block list up to date. + +
+ +> [!NOTE]\ +> Microsoft recommended driver block rules that are enforced as a result of using either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode, are saved in a file called `driversipolicy.p7b` in the `%windir%\system32\CodeIntegrity` directory. +> +> The file you download from Microsoft document is called `SiPolicy.p7b` and it won't overwrite the `driversipolicy.p7b` once deployed. It will work side-by-side the default block rules and will be enforced as well. They are both explicit deny base policies. + +
diff --git a/Wiki posts/App Control for Business/How To Create an App Control Supplemental Policy.md b/Wiki posts/App Control for Business/How To Create an App Control Supplemental Policy.md new file mode 100644 index 000000000..45ef387b7 --- /dev/null +++ b/Wiki posts/App Control for Business/How To Create an App Control Supplemental Policy.md @@ -0,0 +1,59 @@ +# How To Create an App Control Supplemental Policy + +Base policies that have the `Enabled:Allow Supplemental Policies` [rule option](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options) can be extended with supplemental policies. Supplemental policies can be used to expand the scope of a base policy without modifying the base policy itself. This allows you to create a base policy that is shared across multiple devices and then create supplemental policies that are specific to individual devices or groups of devices. + +You can have as many supplemental policies as you need, but each supplemental policy can only be associated with one base policy. + +> [!TIP]\ +> How to differentiate between base and supplemental policies: +> +> The values of `PolicyID` and `BasePolicyID` fields in a base policy are the same, but in a supplemental policy, the `BasePolicyID` field contains the `PolicyID` of the base policy it is associated with. +> +> There are other signs that indicate if a policy is a base or supplemental policy. A supplemental policy can only contain allow rules. A supplemental policy can only have a subset of [the rule options](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options). +> +> Use the [System Information page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information) in the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to view all of the deployed policies and see which ones are base or supplemental. +> + +When it comes to signing, if the base policy is signed, then the supplemental policy must be signed too and vise versa. + +
+ +## Create a Supplemental Policy By Scanning Files and Folders + +Assuming you've already deployed a base policy, you can create a supplemental policy by navigating to the [**Create Supplemental Policy Page**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Supplemental-App-Control-Policy). + +In the **Files and Folders section**, browse for your base policy's XML file. Enter a descriptive name for the supplemental policy that will be created and browse for files and/or folder to scan. If you select folders, they will be scanned recursively, meaning any file in the sub-folders will also be included in the scan. + +The default [level](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Rule-Levels-Comparison-and-Guide) is set to `File Publisher` but you can change it to another level that meets your needs. + +
+ +
+ +Create a Supplemental Policy By Scanning Files and Folders + +
+ +
+ +
+ +After you've submitted the necessary details, press the `Create Supplemental Policy` button. The scan will begin and you will be able to view the progress in real time. If you toggle the `Deploy After Creation` button, the policy will be automatically deployed on the local system, otherwise the XML file will just be created. + +You can customize the XML file further using different pages and features of the AppControl Manager. + +
+ +### FAQs + +Q: What happens if you create a supplemental policy with the same name as an existing one? + +A: Although not recommended as it will make it hard to differentiate between the two in [System Information](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information), you can create a supplemental policy with the same name as an existing one. It won't overwrite the existing one as they will still have different PolicyIDs. + +
+ +Q: What if you create a supplemental policy for an app and then that app is updated? + +A: It all depends on the level you selected for the supplemental policy. If you selected `File Publisher` or `Publisher`, then the policy will still apply to the updated app as long as it is signed by the same publisher. If you selected `Hash`, then the policy will no longer apply to the updated app as the binaries are changed. You will have to scan the new binaries and create a new supplemental policy for them and preferably remove the old one. + +
diff --git a/Wiki posts/App Control for Business/How To Generate Audit Logs via App Control Policies.md b/Wiki posts/App Control for Business/How To Generate Audit Logs via App Control Policies.md new file mode 100644 index 000000000..6424186a8 --- /dev/null +++ b/Wiki posts/App Control for Business/How To Generate Audit Logs via App Control Policies.md @@ -0,0 +1,144 @@ +# How To Generate Audit Logs via App Control Policies + +Audit Logs are generated when a Base policy is deployed with `Audit Mode` rule option. You can configure rule options in policies via [AppControl Manager's features](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Configure-Policy-Rule-Options). + +You can view all of the available rule options in the following [Microsoft Learn page](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options). + +During the Audit mode phase, no file is blocked, instead an audit log in the `Code Integrity/Operational` or `AppLocker` event logs are generated for each file that is executed on the system that would have been blocked if the policy was deployed in enforced mode. + +If the file is a `MSI` installer file or script, then `AppLocker` event is generated for it, otherwise `Code Integrity` will log that file. + +The logs can be collected by the AppControl Manager in order to create Supplemental policies. The logs can also be collected in bulk from thousands of systems by the Microsoft Defender for Endpoint Advanced Hunting and then fed to the AppControl Manager to create Supplemental policies. + +
+ +## Create and Deploy a Base Policy + +First, we have to deploy a base policy. The type of base policy we deploy will determine the kinds of audit logs that will be generated. There are 2 recommended types of base policies you can choose from for this particular scenario. + +1. **Default Windows**, allows the following files and components: + + * Windows Operating System Components + + * Apps installed directly from the Microsoft Store + + * Microsoft 365 apps + + * WHQL-signed Drivers + +2. **Allow Microsoft**, allows the following files and components: + + * Everything that Default Windows policy allows + + * All files and programs signed by Microsoft's certificates. + +
+ +
+ +Base policy deployment in audit mode + +
+ +
+ +
+ +Choose one of the base policies and press the `Create And Deploy` button. After few seconds the policy will be deployed on the system. + +If you want to deploy it on remote systems via Intune, press the `Create` button instead and then use the XML file in the Intune portal for remote deployment. + +
+ +horizontal super thin rainbow RGB line + +
+ +## Generate Audit Event Logs on the System + +To generate audit event logs, start by installing or running the programs and files you want to create a Supplemental policy for. If a program or file is not permitted by the deployed policy in Audit mode, an audit log will be created for it. + + +### Examples + +* If the Default Windows policy is deployed and you install or run applications like GitHub Desktop or Visual Studio, audit logs will be generated since these programs are not permitted by the Default Windows policy. + +* Similarly, deploying the Allow Microsoft policy and then installing a third-party application like VLC Media Player will trigger audit logs for every file executed within that program, as it is not permitted by the Allow Microsoft base policy. + +Keep in mind that only files that are executed during audit mode phase generate event logs, so by simply installing a program using its installer, we can't trigger event log generation for each of the components and executables that each program has. So, after installing the programs, run them, use them a bit as you normally would so that all of the programs' components are executed and event logs generated for them. + +
+ +horizontal super thin rainbow RGB line + +
+ +## Scan the Event Logs + +Navigate to the [AppControl Manager's Event Logs page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Policy-From-Event-Logs), then press the `Scan Logs` Button. + +
+ +
+ +Scan Logs Button in AppControl Manager app + +
+ +
+ +
+ +AppControl Manager will begin scanning all of the related logs in Code Integrity and AppLocker events. Blocked and Audits events will both be included. You can use various User Interface elements and features to filter the logs such as by sorting the columns, filtering based on the date and so on. + +
+ +
+ +Date based filtering in AppControl Manager Event Logs scan + +
+ +
+ +
+ +Once you're done with filtering the logs, press the `Create Policy` button's small arrow on the right. It will open a flyout with 3 options. The options are explained [in this page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Policy-From-Event-Logs#configuration-details). In this case, we need to select the middle option called `Base Policy File` and then select the `Browse` Button. A file picker dialog will open, allowing you to select the base policy XML file that you created and deployed earlier. + +
+ +
+ +Selecting Base policy XML file path in AppControl Manager + +
+ +
+ +
+ +The `Create Policy` button's label is now changed to `Create Policy for Selected Base`. Press it and after few seconds it will create a Supplemental policy for all of the logs displayed in the page. + +
+ +
+ +Selecting Base policy XML file path in AppControl Manager + +
+ +
+ +
+ +From the actions menu you can select to deploy the Supplemental policy after creation too, or you can modify the supplemental policy further using AppControl Manager's other pages. You can [Sign the policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-App-Control-Policy) and make it tamper-proof or [Merge](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Merge-App-Control-Policies) it with other policies. + +
+ +## Wrapping Up + +By now, you should have a solid understanding of how to generate and work with audit logs using AppControl Manager. You've learned how to deploy base policies, trigger audit events, and scan logs to create supplemental policies. + +So go ahead start experimenting, collect those logs, and build policies that fit your environment and if you’re ever unsure about the next steps, the [AppControl Manager documentation](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) is always there to help you out! Plus you can always ask any questions you might have [here on GitHub discussions](https://github.com/HotCakeX/Harden-Windows-Security/discussions). + +
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/How to Create and Deploy a Signed WDAC Policy.md b/Wiki posts/App Control for Business/How to Create and Deploy a Signed WDAC Policy.md similarity index 72% rename from Wiki posts/Windows Defender Application Control (WDAC)/How to Create and Deploy a Signed WDAC Policy.md rename to Wiki posts/App Control for Business/How to Create and Deploy a Signed WDAC Policy.md index 3073e2cc6..3cb6b10a7 100644 --- a/Wiki posts/Windows Defender Application Control (WDAC)/How to Create and Deploy a Signed WDAC Policy.md +++ b/Wiki posts/App Control for Business/How to Create and Deploy a Signed WDAC Policy.md @@ -1,7 +1,7 @@ -# Create and Deploy Signed Application Control (WDAC) Policies +# How to use Windows Server to Create App Control Code Signing Certificate > [!IMPORTANT]\ -> [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) can easily and quickly generate a Code Signing certificate to be used for signing App Control policies. +> [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) can [easily and quickly generate](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Build-New-Certificate) a Code Signing certificate to be used for signing App Control policies. > > This guide is only for those who want to learn how to setup a Windows Server with Active Directory and Certification Authority roles and create their own CA. @@ -13,20 +13,10 @@ * [Refer to Microsoft's website](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-design-guide) or [my other wiki posts](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction) If you want to learn about App Control itself and how to create a customized App Control policy for your own environment. -* Always test and deploy your App Control policy in Audit mode first to make sure it works correctly, before deploying the Signed version of it. - - The [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) has a ***Test Mode*** feature that will deploy the policies with ***Boot Audit on Failure*** and ***Advanced Boot Options Menu*** policy rule options. +* Always test and deploy your App Control policy in Audit mode or Unsigned mode first to make sure it works correctly, before deploying the Signed version of it. + - The [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-App-Control-Policy) has a ***Test Mode*** option when creating policies that will create/deploy the policies with ***Boot Audit on Failure*** and ***Advanced Boot Options Menu*** policy rule options. [You can also add those options to other policies that have already been created.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Configure-Policy-Rule-Options). -* Keep the xml file(s) of the deployed base policy(s) in a safe place, they are needed if you decide to disable or modify the signed deployed App Control policy later on. - -
- -horizontal super thin rainbow RGB line - -
- -## Video Guide - -Create and Deploy Signed WDAC Windows Defender Policy YouTube Guide +* Keep the xml file(s) of the deployed base policy(s) in a safe place, they are needed, along with the certificate that signed them, if you decide to disable or modify the signed deployed App Control policy later on.
@@ -42,7 +32,7 @@ That's essentially everything we have to do. So, if you are already familiar with the concepts, you can go straight to the bottom of this page and use the resources section to refer to Microsoft guides to create and deploy the Signed App Control policy. -But if you aren't familiar, keep reading as I've thoroughly explained every step to set up Windows Server, generate signing certificate and sign the App Control policy. It takes about 20 minutes for me (as you can see in the video) and depending on the hardware, it can even take less time. +But if you aren't familiar, keep reading as I've thoroughly explained every step to set up Windows Server, generate signing certificate and sign the App Control policy. It takes about 20 minutes for me and depending on the hardware, it can even take less time.
@@ -52,20 +42,16 @@ But if you aren't familiar, keep reading as I've thoroughly explained every step ## Prerequisites -Latest Windows Server, it's free for 180 days for evaluation and comes in ISO and VHDX formats. Preferably use Windows Server insider vNext because it has the newest features and visual upgrades. +Latest Windows Server, it's free for 180 days for evaluation and comes in ISO and VHDX formats. -* [Download Windows Server 2022](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2022) from [Microsoft Evaluation Center](https://www.microsoft.com/en-us/evalcenter) -* [Download Windows Server insider vNext](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewserver) - - [Insider activation keys](https://techcommunity.microsoft.com/t5/windows-server-insiders/bd-p/WindowsServerInsiders) - -
+* [Download Windows Server 2025](https://www.microsoft.com/en-us/evalcenter/download-windows-server-2025) from [Microsoft Evaluation Center](https://www.microsoft.com/en-us/evalcenter). Once we have our Windows installation media (ISO or VHDX), we need to set up a Hyper-V VM on our host. For this guide, our host is a Windows 11 pro for workstations machine. Create a Hyper-V VM with these specifications: * Secure Boot -* Trusted Platform Module (TPM) +* Trusted Platform Module (vTPM) * At least 4 virtual processors * At least 4 GB RAM * At least ~20 GB storage @@ -290,61 +276,8 @@ The [Personal Information Exchange (.pfx)](https://learn.microsoft.com/en-us/win ## Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to sign and deploy App Control policies -It supports creating certificates and signing, deploying and removing signed policies. - -You don't need to manually download SignTool.exe but here are some of the sources that it can be retrieved from: - -* [Windows stable SDK **installer**](https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/) -* [Windows Insider SDK **ISO**](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewSDK) -* *SignTool is also included in the [Windows ADK](https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-install) but the one in SDK is the newest and recommended place to get it.* - -
- -horizontal super thin rainbow RGB line - -
- -## System Behavior After Deploying a Signed Application Control Policy - -### Activation Process - -After the signed App Control policy binary `.cip` is copied to the `EFI` partition as part of the deployment process, and system is restarted once, we can see in System Information that Application Control User-Mode is being enforced and when you try to install an application not permitted by the deployed policy, it will be successfully blocked. - -At this point, since we are using UEFI Secure Boot, the **Anti Tampering** protection of the **Signed policy** kicks in and starts protecting App Control policy against any tampering. We need to reboot the system one more time, [to verify everything](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/use-signed-policies-to-protect-appcontrol-against-tampering#verify-and-deploy-the-signed-policy) and make sure there is no boot failure. - -Deploying a Signed App Control policy **without restarting** is the same as deploying Unsigned policies, because the Signed policy can be easily removed just like an Unsigned policy. So always make sure you restart at least once after deploying a Signed App Control policy. - -
- -### If Someone forcefully deletes the deployed App Control policy file - -* Deleting the `.cip` policy file from `C:\Windows\System32\CodeIntegrity\CiPolicies\Active` and then restarting the system multiple times won't have any effect at all on the status of App Control. It will continue to work, and enforcement status will be shown in System Information. **This is how it protects itself against rogue administrators.** - -* Deleting the `.cip` policy file from the `EFI` partition located at `\EFI\Microsoft\Boot\CIPolicies\Active` and restarting the device will result in a boot failure. Before system restart, nothing happens and it will remain active. This is another self-protection method of a Signed App Control policy. To recover from this state, the person will need to disable Secure Boot in the UEFI firmware settings. There are only 3 scenarios at this point: - - 1. If, as suggested in the [Security Recommendations](https://github.com/HotCakeX/Harden-Windows-Security#security-recommendations), you set a strong password for the UEFI firmware of your hardware, they can't access the firmware. This security measure [alongside the rest of the Windows built-in security features](https://github.com/HotCakeX/Harden-Windows-Security) such as BitLocker device encryption will provide the **Ultimate protection for a Windows device against any threats and any person, no matter physical, real-life or Internet threats.** - - 2. If UEFI firmware is not password protected, the person can disable Secure Boot and/or TPM in UEFI firmware settings, they can even flash the entire UEFI firmware memory by physically abusing the device to get past the UEFI password, but since the device is BitLocker protected, **a total Lock Down will be triggered** and the person will need to provide the 48-digit recovery key of the OS drive in order to even complete the boot process into Windows lock screen. Assuming the person also has access to the Windows PIN, they will additionally need to provide 48-digit recovery password of any subsequent BitLocker protected drive(s) in order to access them (if the drive(s) aren't set to be auto-unlocked with OS drive). **This is more than Security-In-Depth.** If UEFI firmware has any unpatched vulnerability, Device Guard features will take care of it. - - 3. Since steps 1 and 2 are impossible to bypass for a rouge person, there will be only one option left. To completely recycle the physical device, get rid of the inaccessible hardware such as SSD and then sell the remaining hardware parts. Either way, **your data remains secure and inaccessible to any unauthorized person(s) at all times.** - -
Screenshot of a message after forcefully deleting a Signed App Control policy from the EFI partition - -Screenshot of a message after forcefully deleting a Signed App Control policy from the EFI partition - -
- -
- -### What Happens When We Turn On Smart App Control - -Smart App Control works side-by-side any signed or unsigned App Control policy because it is itself a special type of App Control policy. It will be in enforced mode and continue to do its job. - -
- -### Dual boot OS configurations - -When you deploy a **Signed** App Control policy on a system that uses Secure Boot, it will be enforced on all of the OSes that boot on the physical machine, because the policy resides on the EFI partition and is not tied to any specific OS. That means if you perform a clean install of a second Windows OS or natively boot a VHDX (Hyper-V VM), the policy will apply to them as well. +> [!TIP]\ +> AppControl Manager has everything built-in for you. You can [**Deploy**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-App-Control-Policy), [**Modify**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Allow-New-Apps) and [**Remove**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information#policy-removal) Signed policies.
@@ -411,12 +344,11 @@ then FQDN is: `CAServer.CAServer.com` * [Use signed policies to protect App Control for Business against tampering](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/use-signed-policies-to-protect-appcontrol-against-tampering) * [Create a code signing cert for App Control for Business](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/create-code-signing-cert-for-appcontrol) * [Deploying signed policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script#deploying-signed-policies) -* [WDAC Policy Wizard](https://webapp-wdac-wizard.azurewebsites.net/) -* [WDAC policy creation - Australian Government](https://desktop.gov.au/blueprint/abac/wdac-policy-creation.html) +* [App Control Policy Wizard](https://webapp-wdac-wizard.azurewebsites.net/) +* [Application Control - Australian Government](https://blueprint.asd.gov.au/security-and-governance/essential-eight/application-control/) * [Understand App Control for Business policy rules and file rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create) * [Install Active Directory Domain Services](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-active-directory-domain-services--level-100-) * [Install-AdcsCertificationAuthority](https://learn.microsoft.com/en-us/powershell/module/adcsdeployment/install-adcscertificationauthority) * [Install the Certification Authority](https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/install-the-certification-authority) -* [Comparison of Standard, Datacenter, and Datacenter: Azure Edition editions of Windows Server 2022](https://learn.microsoft.com/en-us/windows-server/get-started/editions-comparison-windows-server-2022?tabs=full-comparison) +* [Comparison of Windows Server editions](https://learn.microsoft.com/en-us/windows-server/get-started/editions-comparison) * [Remove App Control for Business policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies) -* [Add-SignerRule](https://learn.microsoft.com/en-us/powershell/module/configci/add-signerrule) diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/How to Use Microsoft Defender for Endpoint Advanced Hunting With WDAC App Control.md b/Wiki posts/App Control for Business/How to Use Microsoft Defender for Endpoint Advanced Hunting With WDAC App Control.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/How to Use Microsoft Defender for Endpoint Advanced Hunting With WDAC App Control.md rename to Wiki posts/App Control for Business/How to Use Microsoft Defender for Endpoint Advanced Hunting With WDAC App Control.md diff --git a/Wiki posts/App Control for Business/Introduction.md b/Wiki posts/App Control for Business/Introduction.md new file mode 100644 index 000000000..5c128c5dd --- /dev/null +++ b/Wiki posts/App Control for Business/Introduction.md @@ -0,0 +1,183 @@ +# What is Application Control for Business? + +
+App Control for Business introduction +
+ +
+ +Application Control is crucial for protecting computer systems in today's threat landscape and offers a distinct advantage over traditional antivirus solutions. Specifically, application control uses tailored access, shifting from a model where all applications are assumed trustworthy to one where applications must earn trust before they can run. + +Devices where Application Control policies are deployed on can either be centrally managed via MDM, Intune etc. or they can be home devices, devices that are private and don't belong to any organization, the computer of someone that you want to keep very much safe and secure [so that even the device's owner can't willingly or forcefully compromise themselves,](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control) the possibilities are endless. + +
+ +> [!IMPORTANT]\ +> Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) for all of your Application Control and Code Integrity management needs. It is scalable, easy to use, enterprise-ready, Azure VM ready and more importantly, it is free, open-source and always will be that way. + +
+ +App Control puts the power of security directly in your hands, giving you complete control over your system and the systems you manage. Unlike other solutions that create dependency on other people, App Control eliminates the need to constantly chase and block new malware variants. Once you configure your system and define the apps and files that are permitted to run, everything else is automatically blocked. + +**It's time to shift from a reactive approach to a proactive one.** + +
+ +## But What Is App Control in Simpler Terms? + +By default, you can install any program and run any file on your system. These files can either be signed or unsigned. Signed files come with a certificate that verifies their authenticity, and Windows maintains [a list of trusted certificates](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/certificate-trust). + +Application Control is a security feature designed to regulate and restrict which programs and files are allowed to run on your system. It eliminates the default open-ended approach where any file can be executed freely. Instead, you define a policy—formatted as an XML file—that specifies which certificates or files are trusted. The system then enforces this policy, permitting only the approved files and programs to run while blocking everything else. + +This fundamentally changes the security landscape. Instead of allowing everything by default, the system now demands that programs and files prove their trustworthiness to the policy you created, before execution. + +**App Control operates on the principle of trust enforcement rather than threat detection.** It does not distinguish between outright malware and files signed with multiple legitimate certificates—if a file is not explicitly permitted by your locally defined policy, it is blocked from execution. This proactive approach is particularly effective against zero-day threats that may evade traditional antivirus, signature-based, or other detection mechanisms. Waiting even a short period for new threats to be detected, analyzed, and countered with updated signatures can be too late. + +By preventing the execution of any unauthorized files or programs, App Control imposes significant barriers to attackers, potentially deterring them from even attempting to breach your system. For instance, even if an attacker manages to deceive you into downloading seemingly legitimate software or file to exploit vulnerabilities or infect your device (such as through social engineering, phishing and other techniques), it will be denied execution unless it adheres to the locally defined policy(ies) on your system. + +> [!TIP]\ +> [App Control Frequently Asked Questions (FAQs)](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Application-Control-(WDAC)-Frequently-Asked-Questions-(FAQs)) + +
+ +## What Are The Different Ways to Use App Control in Windows? + +Windows includes a feature called [Smart App Control](https://support.microsoft.com/en-us/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003). It acts as a fully automated Application Control system for your device. Being fully automated means it cannot be manually configured or overridden. Smart App Control leverages [the Microsoft Intelligent Security Graph](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph#how-does-wdac-work-with-the-isg), which utilizes AI and advanced technologies to assess whether a file or program is safe to execute. + +For those seeking more granular control, [**the AppControl Manager**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) offers a highly intuitive graphical interface. It allows you to create detailed policies, specifying which files or programs are permitted to run. Policies can be defined using various criteria within the XML format. For example, you can create rules to block all files from running in a particular folder or allow only files signed with a specific certificate, effectively blocking unsigned or differently signed files. AppControl Manager provides a comprehensive suite of tools to manage and configure App Control on your system. With all functionalities built directly into the app, it eliminates the need to switch between different tools or interfaces, making the process seamless and efficient. + +App Control is deeply integrated into Windows core and a component known as Code Integrity is mainly responsible for enforcing App Control policies that we create. It runs very early during the system boot, ensuring tight policy enforcement from the very beginning. + +
+ +## App Control Concepts and Keywords + +### Base Policy + +App Control policies come in different types, one of which is the base policy. A base policy is a standalone policy that can be deployed independently, without relying on other policies. It can contain both allow and deny rules. Multiple base policies can coexist on the same system. + +
+ +### Supplemental policy + +Supplemental policies depend on base policies and cannot function without an associated base policy. The only purpose of a supplemental policy is to add more allow rules to a base policy, thereby expanding its scope. + +
+ +### AppID Tagging Policy + +This type of policy does not allow or block any files. Instead, it programmatically tags files and programs based on the rules defined within it. Other programs can then detect these tags and treat the tagged programs differently. + +
+ +### Table: Policy Types and Their Capabilities + +| Features | Base Policy | Supplemental Policy | AppID Tagging Policy | +|-----------------------------------------------------------------------------|-------------|---------------------|----------------------| +| Can be Standalone | Yes | No | Yes | +| Can Have Deny Rules | Yes | No | No | +| Applies to User and Kernel Mode Files? | Yes | Yes | No - User Mode only | +| Can be Signed | Yes | Yes | Yes | +| Can the Signed Version be Removed Without Access to the Certificate? | No | Yes | No | +| Can be Used for Auditing | Yes | No | No | + +
+ +### Policy ID + +All policy types are assigned a unique ID in GUID format. No two policies with the same ID can exist on the same system. Attempting to deploy a policy with a duplicate ID will overwrite the existing policy. + +
+ +### Deployment + +The terms deploy or deployment refer to the process of installing policies on the system. Deployment involves: + +* Copying the policy to specific system locations. + +* Refreshing the system's policy repository to recognize and enforce the new policies. + +
+ +### Audit Mode + +Audit Mode is a feature available for base policies. When deployed in audit mode, the policy does not block any files. Instead, it generates event logs for any files that would have been blocked if the policy were deployed in enforced mode. + +
+ +### Enforced Mode + +If a policy is not deployed in audit mode, it is considered to be in enforced mode. In this mode: + +* The policy enforces its rules by allowing specified files and programs. + +* All other files and programs are blocked. + +
+ +## App Control Guides + +* [How To Generate Audit Logs via App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Generate-Audit-Logs-via-App-Control-Policies) + +* [How To Create an App Control Supplemental Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Create-an-App-Control-Supplemental-Policy) + +* [The Strength of Signed App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/The-Strength-of-Signed-App-Control-Policies) + +* [Fast and Automatic Microsoft Recommended Driver Block Rules updates](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Fast-and-Automatic-Microsoft-Recommended-Driver-Block-Rules-updates) + +* [App Control Notes](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes) + +* [How to use Windows Server to Create App Control Code Signing Certificate](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control) + +* [App Control policy for BYOVD Kernel mode only protection](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) + +* [EKUs in App Control for Business Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/EKUs-in-WDAC,-App-Control-for-Business,-Policies) + +* [App Control Rule Levels Comparison and Guide](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Rule-Levels-Comparison-and-Guide) + +* [Script Enforcement and PowerShell Constrained Language Mode in App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Script-Enforcement-and-PowerShell-Constrained-Language-Mode-in-WDAC-App-Control-Policies) + +* [How to Use Microsoft Defender for Endpoint Advanced Hunting With App Control](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Use-Microsoft-Defender-for-Endpoint-Advanced-Hunting-With-WDAC-App-Control) + +
+ +## Application Control Usage Levels + +There are many ways you can utilize Application Control features and here they are sorted by the level of restriction and protection they provide. + +| Protection Level |Type | Description | +|:----------------:|:---:|:-----------:| +|⭐| Microsoft recommended driver block rules| The vulnerable driver blocklist is enabled by default for all devices using HVCI or Memory Integrity. [The built-in driver blocklist is updated with each new major release of Windows, typically 1-2 times per year.](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) | +|⭐⭐|Fast Microsoft recommended driver block rules Update| The drivers block list itself [is updated more frequently](https://github.com/MicrosoftDocs/windows-itpro-docs/commits/public/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md) than twice a year schedule, [use the AppControl Manager to setup a scheduled task that keeps the list up-to-date.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Fast-and-Automatic-Microsoft-Recommended-Driver-Block-Rules-updates) | +|⭐⭐⭐| Microsoft recommended driver + User Mode block rules | Use the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to easily deploy the User-Mode Microsoft recommended block rules on your system in addition to the drivers block rules that only enforces Kernel-mode drivers.| +|⭐⭐⭐⭐| Block Rules + App Control policy using ISG | In Addition to using the block rules, deploy an App Control policy that uses the [ISG](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph#how-does-wdac-work-with-the-isg) for automated reputation-based authorization. | +|⭐⭐⭐⭐⭐|Smart App Control| It's just a toggle in Windows Security under App & Browser control. [Smart App Control](https://support.microsoft.com/en-us/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) uses a special kind of App Control policy that provides more protection than the previous type because of how it is crafted to handle reputable apps. It uses both of Microsoft's recommended block rules by default.| +|⭐⭐⭐⭐⭐⭐| Smart App Control + Strict Kernel-Mode App Control Policy | The [special strict kernel-mode policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) augments the Smart App Control by enforcing tight restrictions and control over anything that wants access the OS Kernel.| +|⭐⭐⭐⭐⭐⭐⭐| Block Rules + Allow Microsoft policy (unsigned)| Block rules must always be deployed along with other App Control policies. The Allow Microsoft policy will enforce both User + Kernel mode files.| +|⭐⭐⭐⭐⭐⭐⭐⭐| Block Rules + Allow Microsoft policy (Signed)| Signing the Allow Microsoft policy along with the block rules will make them tamper proof even against system administrators.| +|⭐⭐⭐⭐⭐⭐⭐⭐⭐| Block Rules + Default Windows (unsigned)| The Default Windows template offers more control and restrictions than the Allow Microsoft template.| +|⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐| Block Rules + Default Windows (Signed)| Signing the Default Windows policy along with the block rules will make them tamper proof even against system administrators.| +|⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐⭐ | Block Rules + Default Windows + Strict Kernel-Mode policy (All Policies Signed) | the Default Windows policy + Strict Kernel-mode policy + block rules and all of them signed provides the highest level of protection. | + +
+ +## Microsoft Learn Documents Related to Application Control + +* [Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol) +* [Understand App Control for Business policy design decisions](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/understand-appcontrol-policy-design-decisions) +* [Deploying App Control for Business policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide) +* [Use multiple App Control for Business Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/deploy-multiple-appcontrol-policies) +* [Use audit events to create App Control policy rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies) +* [Understand App Control for Business policy rules and file rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#app-control-for-business-policy-rules) +* [Testing and Debugging AppId Tagging Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/debugging-operational-guide-appid-tagging-policies) +* [App Control for Business example base policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/example-appcontrol-base-policies) +* [Configure the Application Identity service](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service) +* [Microsoft recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) +* [Microsoft recommended block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol) +* [Create an App Control policy using a reference computer](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-using-reference-computer) +* [Create an App Control policy for fully managed devices](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-fully-managed-devices) +* [Create an App Control policy for lightly managed devices](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-lightly-managed-devices) +* [Guidance on Creating App Control Deny Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-deny-policy) +* [Hypervisor-protected Code Integrity enablement](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-hvci-enablement) + +
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/Script Enforcement and PowerShell Constrained Language Mode in WDAC App Control Policies.md b/Wiki posts/App Control for Business/Script Enforcement and PowerShell Constrained Language Mode in WDAC App Control Policies.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/Script Enforcement and PowerShell Constrained Language Mode in WDAC App Control Policies.md rename to Wiki posts/App Control for Business/Script Enforcement and PowerShell Constrained Language Mode in WDAC App Control Policies.md diff --git a/Wiki posts/App Control for Business/The Strength of Signed App Control Policies.md b/Wiki posts/App Control for Business/The Strength of Signed App Control Policies.md new file mode 100644 index 000000000..452045f22 --- /dev/null +++ b/Wiki posts/App Control for Business/The Strength of Signed App Control Policies.md @@ -0,0 +1,87 @@ +# The Strength of Signed App Control Policies + +
+ +
+ +![image](https://github.com/user-attachments/assets/37b36dfe-ce2c-494b-bdc6-e4a71f0ed9ff) + +
+ +
+ +
+ +Before delving into the topic, let's first clarify the role of an Administrator within the operating system. An Administrator is a user with the highest level of access to the OS, possessing the authority to make system-wide changes that impact all users. + +**Administrators are responsible for managing system security**, modifying security settings, installing software and hardware, and accessing all files on the computer. Notably, an Administrator can seamlessly elevate privileges to SYSTEM, Managed Installer, or other access levels due to the absence of [security boundaries](https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria) between them. Equivalent roles in other operating systems include Root, SuperUser, and similar designations. + +Implementing an Application Control policy requires Administrator privileges. Without these elevated permissions, it is impossible to deploy, remove, or alter any App Control policies. + +Deploying an unsigned App Control policy leaves it vulnerable to removal or modification by any user with Administrator privileges. But what if you need your App Control policy to be so tamper-resistant that even an Administrator cannot alter or remove it? This is where signing comes into play. + +App Control policies, authored in XML format, must be converted into .cip binary files before deployment. To enhance security and ensure tamper resistance, the .cip file can be signed with a code signing certificate prior to deployment. This signing process effectively fortifies the policy, making it impervious to unauthorized modifications or removal. + +Signed App Control policies offer a formidable defense, they significantly hinder adversaries from achieving initial access to the system, a critical juncture in any attack. The importance of preventing initial access cannot be overstated. Once an attacker gains Administrator privileges, they inherently acquire the capability to manipulate the system. + +For example, although a signed App Control policy cannot be removed, an attacker with Administrator rights could still deploy a new policy designed to block essential Endpoint Detection and Response (EDR) sensors or data collection agents. This could include tools like Azure Monitor Agent for Microsoft Sentinel or Microsoft Defender for Endpoint, effectively disrupting telemetry and impeding security monitoring. + +Despite this potential for disruption, attackers are still constrained by the integrity of signed policies, which prohibit unauthorized programs from executing. Consequently, engineering robust defenses to prevent initial access, particularly access that elevates privileges to Administrator, remains paramount in securing modern systems. + +
+ +## System Behavior After Deploying a Signed Application Control Policy + +### Activation Process + +After a signed App Control policy .cip is copied to the EFI partition as part of the deployment process, we can see in [System Information](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information) that Application Control User-Mode is being enforced and when you try to install an application not permitted by the deployed policy, it will be successfully blocked. + +At this point, we need to restart the system. since we are using UEFI Secure Boot, the Anti Tampering protection of the Signed policy kicks in and starts protecting App Control policy against any tampering. + +Deploying a Signed App Control policy without restarting is the same as deploying Unsigned policies, because the Signed policy can be easily removed just like an Unsigned policy. So always make sure you restart at least once after deploying a Signed App Control policy. + +
+ +### If Someone Forcefully Deletes the Deployed App Control Policy File + +* Deleting the .cip policy file from `C:\Windows\System32\CodeIntegrity\CiPolicies\Active` and then restarting the system multiple times won't have any effect at all on the status of App Control. It will continue to work, and enforcement status will be shown in System Information. This is how it protects itself against rogue administrators. + +* Deleting the .cip policy file from the EFI partition located at `\EFI\Microsoft\Boot\CIPolicies\Active` and restarting the device will result in a boot failure. Before system restart, nothing happens and it will remain active. This is another self-protection method of a Signed App Control policy. To recover from this state, the person will need to disable Secure Boot in the UEFI firmware settings. There are only 3 scenarios at this point: + + 1. If, as suggested in the [Security Recommendations](https://github.com/HotCakeX/Harden-Windows-Security#security-recommendations), you set a strong password for the UEFI firmware of your hardware, they can't access the firmware. This security measure [alongside the rest of the Windows built-in security features](https://github.com/HotCakeX/Harden-Windows-Security) such as BitLocker device encryption will provide the Ultimate protection for a Windows device against threats, whether physical or originating from the Internet. + + 2. If UEFI firmware is not password protected, the person can disable Secure Boot and/or TPM in UEFI firmware settings, they can even flash the entire UEFI firmware memory by physically abusing the device to get past the UEFI password, but since the device is BitLocker protected, **a total Lock Down will be triggered** and the person will need to provide the 48-digit recovery key of the OS drive in order to even complete the boot process into Windows lock screen. Assuming the person also has access to the Windows PIN, they will additionally need to provide 48-digit recovery password of any subsequent BitLocker protected drive(s) in order to access them (if the drive(s) aren't set to be auto-unlocked with the OS drive). **This is more than Security-In-Depth.** If UEFI firmware has any unpatched vulnerability, Device Guard features will take care of it. + + 3. Since steps 1 and 2 are impossible to bypass for a rogue person, there will be only one option left. To completely recycle the physical device, get rid of the inaccessible hardware such as SSD and then sell the remaining hardware parts. Either way, your data remains secure and inaccessible to any unauthorized person(s) at all times. + +
Screenshot of a message after forcefully deleting a Signed App Control policy from the EFI partition in a VM + +Screenshot of a message after forcefully deleting a Signed App Control policy from the EFI partition + +
+ +
+ +### What Happens When We Turn On Smart App Control + +Smart App Control works side-by-side any signed or unsigned App Control policy because it is itself a special type of App Control policy. It will be in enforced mode and continue to do its job. + +
+ +### Dual boot OS configurations + +When you deploy a **Signed** App Control policy on a system that uses Secure Boot, it will be enforced on all of the OSes that boot on the physical machine, because the policy resides on the EFI partition and is not tied to any specific OS. That means if you perform a clean install of a second Windows OS or natively boot a VHDX (Hyper-V VM), the policy will apply to them as well. + +
+ +> [!TIP]\ +> Continue reading: +> +> * [Penetration Testing and Benchmarking](https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Rationale.md#-for-penetration-testing-and-benchmarking) +> +> * [Deploying Signed App Control policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-App-Control-Policy) +> +> * [Creating Code Signing Certificate via AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Build-New-Certificate) +> + +
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC Notes.md b/Wiki posts/App Control for Business/WDAC Notes.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/WDAC Notes.md rename to Wiki posts/App Control for Business/WDAC Notes.md diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC Rule Levels Comparison and Guide.md b/Wiki posts/App Control for Business/WDAC Rule Levels Comparison and Guide.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/WDAC Rule Levels Comparison and Guide.md rename to Wiki posts/App Control for Business/WDAC Rule Levels Comparison and Guide.md diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC policy for BYOVD Kernel mode only protection.md b/Wiki posts/App Control for Business/WDAC policy for BYOVD Kernel mode only protection.md similarity index 100% rename from Wiki posts/Windows Defender Application Control (WDAC)/WDAC policy for BYOVD Kernel mode only protection.md rename to Wiki posts/App Control for Business/WDAC policy for BYOVD Kernel mode only protection.md diff --git a/Wiki posts/AppControl Manager/Allow New Apps.md b/Wiki posts/AppControl Manager/Allow New Apps.md index e14450bbc..8b8364af5 100644 --- a/Wiki posts/AppControl Manager/Allow New Apps.md +++ b/Wiki posts/AppControl Manager/Allow New Apps.md @@ -1,5 +1,15 @@ # Allow New Apps +
+ +AppControl Manager Application's Allow New Apps Page + +
+ +
+ +
+ This page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) is designed as a practical hub for managing App Control on your system. Consider it your centralized solution for effortlessly overseeing your app-related policies and allowing new apps. When you need to install a new application, this page provides an intuitive way to temporarily enable Audit mode in your existing base policy. This allows the installation of the app while ensuring the base policy automatically reverts to Enforced mode immediately afterward. @@ -17,6 +27,9 @@ If something like a power outage occurs during the audit mode phase, on the next > [!NOTE]\ > This feature can also detect and create supplemental policy for Kernel protected files, such as the executables of games installed using Xbox app. Make sure you run the game while the base policy is deployed in Audit mode so that it can capture those executables. +> [!TIP]\ +> You can use both Signed and Unsigned App Control policies. The app will automatically detect the signing status of the XML policy file that you select and prompt for any additional information required. +
## Configuration Details diff --git a/Wiki posts/AppControl Manager/AppControl Manager.md b/Wiki posts/AppControl Manager/AppControl Manager.md index 4930afc56..7148d0b7f 100644 --- a/Wiki posts/AppControl Manager/AppControl Manager.md +++ b/Wiki posts/AppControl Manager/AppControl Manager.md @@ -2,12 +2,12 @@ AppControl Manager is a modern secure app that provides easy to use graphical user interface to manage App Control and Code Integrity on your device. -The short-term goal is for the AppControl manager to reach feature parity with the [WDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) Powershell module, as fast as possible, and then to surpass it with new unique features and improvements. +**⚡What is App Control? [Check Out This Article ⚡](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction)** + +
> [!IMPORTANT]\ > The AppControl Manager application is built publicly using a [GitHub action](https://github.com/HotCakeX/Harden-Windows-Security/actions/workflows/Build%20AppControl%20Manager%20MSIX%20Package.yml) and uploaded to the GitHub release. The action uses [Artifact Attestation](https://github.com/HotCakeX/Harden-Windows-Security/attestations) and [SBOM (Software Bill of Materials)](https://github.com/HotCakeX/Harden-Windows-Security/network/dependencies) generation to comply with [SLSA](https://slsa.dev/spec/v1.0/levels) level 2 and [security standards](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds). The source code as well as the package is [uploaded to Virus Total](https://github.com/HotCakeX/Harden-Windows-Security/actions/workflows/VirusTotal.yml) automatically. Also [GitHub's CodeQL Advanced workflow](https://github.com/HotCakeX/Harden-Windows-Security/actions/workflows/codeql.yml) with extended security model scans the entire repository. -> -> **What is App Control for business? [check out this article](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction)**
@@ -121,6 +121,18 @@ AppControl Manager is engineered with a security-first approach from the ground
+### Where Are The Temporary Files Saved To? + +The Temporary Files Are Stored in the Following Directory + +``` +C:\Program Files\WDACConfig\StagingArea +``` + +Each applicable feature of the AppControl Manager that you start using will generate a uniquely named subdirectory within the StagingArea to store its temporary files (if needed). Upon closing the application, the entire StagingArea directory, along with its contents, will be automatically deleted. These files are utilized by the application for tasks such as creating policies, storing temporary scan results, and other related functions. + +
+ ## About the Installation Process The installation process for AppControl Manager is uniquely streamlined. When you execute the PowerShell one-liner command mentioned above, it initiates [a file](https://github.com/HotCakeX/Harden-Windows-Security/blob/main/Harden-Windows-Security.ps1) containing the `AppControl` function, which serves as the bootstrapper script. This script is thoroughly documented, with detailed explanations and justifications for each step, as outlined below: @@ -194,11 +206,11 @@ AppControl -MSIXPath "Path To the MSIX" -SignTool "Path to signtool.exe" -Verbos # FAQs * Q: Why isn't AppControl Manager on Microsoft Store? -* A: Because Microsoft Store currently does not accept apps that require Administrator privileges to run (i.e., MediumIL). +* A: Because Microsoft Store currently does not accept apps that require Administrator privileges to run [(i.e., MediumIL)](https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control).
* Q: Why isn't the MSIX package pre-signed? -* A: Because I haven't started paying for a code-signing certificate yet. +* A: Because I haven't started paying for a code-signing certificate yet. [Read more about signing](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Rethinking-Trust:-Advanced-Security-Measures-for-High%E2%80%90Stakes-Systems)
diff --git a/Wiki posts/AppControl Manager/Build New Certificate.md b/Wiki posts/AppControl Manager/Build New Certificate.md index 612c71c85..e21b9998b 100644 --- a/Wiki posts/AppControl Manager/Build New Certificate.md +++ b/Wiki posts/AppControl Manager/Build New Certificate.md @@ -1,17 +1,30 @@ # Build New Certificate +
+ +AppControl Manager Application's Build New Certificate Page + +
+ +
+ +
+ Use this page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to build a new Code Signing certificate that is suitable for signing App Control policies according to the [Microsoft's requirements](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/use-signed-policies-to-protect-appcontrol-against-tampering). This page offers multiple options to configure the generated certificate according to your needs and requirements. The keys use `SHA2-512` hashing algorithm. You will see a prompt asking for password during certificate building process. This is the password that will be used to protect the certificate's private key on your system. You can uncheck the box for passwords and only use confirmation prompts. The password or confirmation prompt will be displayed to you every time the private key of the certificate is going to be used to sign a file. +After building the certificate, 2 files will be created in the `C:\Program Files\WDACConfig` directory with `.cer` and `.pfx` extensions and the same name as the common name you selected. + + * The file with the `.cer` extension contains the public key of the certificate. + + * The file with the `.pfx` extension contains the private key of the certificate. You need make sure you will have access to these files when [deploying signed policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-App-Control-Policy#configuration-details-for-signed-deployment) because they will be needed whenever you need to [change](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Allow-New-Apps) or [remove a signed policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/System-Information#removing-signed-base-policies) from the system. +
## Configuration Details -* **Key Size**: The cryptographic key's length, measured in bits, defines the strength and security of private key encryption. Bigger key sizes take more time and processing power to generate. It uses RSA algorithm. - -> [!IMPORTANT]\ -> App Control only supports key sizes up to `4096` so do not change the key size if you want to use the generated code signing certificate for App Control policy signing. +* **Key Size**: The cryptographic key's length, measured in bits, defines the strength and security of private key encryption. Bigger key sizes take more time and processing power to generate. It uses RSA algorithm. App Control only supports key sizes up to `4096`. * **Common Name**: The Common Name (CN) is a field in a certificate that specifies the fully qualified domain name (FQDN) or identifier the certificate is issued for. diff --git a/Wiki posts/AppControl Manager/Configure Policy Rule Options.md b/Wiki posts/AppControl Manager/Configure Policy Rule Options.md index 8d11d5dec..d834b8e8f 100644 --- a/Wiki posts/AppControl Manager/Configure Policy Rule Options.md +++ b/Wiki posts/AppControl Manager/Configure Policy Rule Options.md @@ -1,5 +1,15 @@ # Configure Policy Rule Options +
+ +AppControl Manager Application's Configure Policy Rule Options Page + +
+ +
+ +
+ Use this page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to configure the rule options in an App Control policy. You can find all of the available rule options and their descriptions in [this Microsoft Learn page](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options). Additionally, this page offers policy templates. These are pre-configured set of rule options suitable for each use case. Use the drop down menu to select one and apply it to an XML policy file. diff --git a/Wiki posts/AppControl Manager/Create AppControl Policy.md b/Wiki posts/AppControl Manager/Create AppControl Policy.md index 072f3d5d2..cf7b15508 100644 --- a/Wiki posts/AppControl Manager/Create AppControl Policy.md +++ b/Wiki posts/AppControl Manager/Create AppControl Policy.md @@ -1,5 +1,15 @@ # Create App Control Policy +
+ +AppControl Manager Application's Create App Control Policy Page + +
+ +
+ +
+ Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to create new App Control policies based on the [default templates](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/example-appcontrol-base-policies). * **Allow Microsoft**: Only allows files signed by Microsoft certificates to run on the system. @@ -12,7 +22,7 @@ Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wik * **Microsoft Recommended Driver Block Rules**: It will download the latest Microsoft Recommended (Kernel-Mode) block rules from [the official source](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) and create an App Control policy. - * **Auto update**: It will create a scheduled task on the system that will check every week for the latest Microsoft Recommended block rules and update the policy automatically. + * **Auto update**: It will create a scheduled task on the system that will check every week for the latest Microsoft Recommended block rules and update the policy automatically. [Please refer to this page for more info.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Fast-and-Automatic-Microsoft-Recommended-Driver-Block-Rules-updates)
diff --git a/Wiki posts/AppControl Manager/Create Deny Policy.md b/Wiki posts/AppControl Manager/Create Deny Policy.md index d599fd677..ff0b4b287 100644 --- a/Wiki posts/AppControl Manager/Create Deny Policy.md +++ b/Wiki posts/AppControl Manager/Create Deny Policy.md @@ -1,5 +1,15 @@ # Create Deny Policy +
+ +AppControl Manager Application's Create Deny Policy Page + +
+ +
+ +
+ Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to create Deny App Control policies. Keep in mind that App Control is inherently a whitelisting feature so anything that is not allowed by a policy is already automatically blocked. All Deny policies have *Base* policy types as other types such as Supplemental cannot have Deny rules in them. diff --git a/Wiki posts/AppControl Manager/Create Policy From Event Logs.md b/Wiki posts/AppControl Manager/Create Policy From Event Logs.md index 9183f7c41..b920f5ff8 100644 --- a/Wiki posts/AppControl Manager/Create Policy From Event Logs.md +++ b/Wiki posts/AppControl Manager/Create Policy From Event Logs.md @@ -1,5 +1,15 @@ # Create Policy From Event Logs +
+ +AppControl Manager Application's Create Policy From Event Logs Page + +
+ +
+ +
+ This page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) allows you to create Application Control policies directly from local event logs or EVTX files. It focuses on processing Code Integrity and AppLocker event logs to help build tailored policies. This page offers a data grid that has search functionality, sorting, removal of individual logs and copying entire rows or each cell to the clipboard. diff --git a/Wiki posts/AppControl Manager/Create Policy From MDE Advanced Hunting.md b/Wiki posts/AppControl Manager/Create Policy From MDE Advanced Hunting.md index 3ac57a687..399b473c2 100644 --- a/Wiki posts/AppControl Manager/Create Policy From MDE Advanced Hunting.md +++ b/Wiki posts/AppControl Manager/Create Policy From MDE Advanced Hunting.md @@ -1,5 +1,15 @@ # Create Policy From MDE Advanced Hunting +
+ +AppControl Manager Application's Create Policy From MDE Advanced Hunting Page + +
+ +
+ +
+ Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to create App Control policies based on Microsoft Defender for Endpoint (MDE) Advanced Hunting exported CSV logs. [**Refer to this page for more information**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Use-Microsoft-Defender-for-Endpoint-Advanced-Hunting-With-WDAC-App-Control). This page offers a data grid that has search functionality, sorting, removal of individual logs and copying entire rows or each cell to the clipboard. diff --git a/Wiki posts/AppControl Manager/Create Supplemental Policy.md b/Wiki posts/AppControl Manager/Create Supplemental Policy.md index 47afde5dd..80fb030bd 100644 --- a/Wiki posts/AppControl Manager/Create Supplemental Policy.md +++ b/Wiki posts/AppControl Manager/Create Supplemental Policy.md @@ -1,5 +1,15 @@ # Create Supplemental App Control Policy +
+ +AppControl Manager Application's Create Supplemental App Control Policy Page + +
+ +
+ +
+ Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to create Supplemental App Control policies for your base policies. Use Supplemental policies to expand the scope of your base policies by allowing more files or applications.
diff --git a/Wiki posts/AppControl Manager/Deploy App Control Policy.md b/Wiki posts/AppControl Manager/Deploy App Control Policy.md index abdd67e4e..dbba085d7 100644 --- a/Wiki posts/AppControl Manager/Deploy App Control Policy.md +++ b/Wiki posts/AppControl Manager/Deploy App Control Policy.md @@ -1,10 +1,20 @@ # Deploy App Control Policy +
+ +AppControl Manager Application's Deploy App Control Policy Page + +
+ +
+ +
+ Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to select XML policy files or `.cip` binary files to deploy on the system.
-## Configuration Details +## Configuration Details for Unsigned Deployment * **Select XML Policy File(s)**: Use this button to browse for App Control XML policy files. @@ -13,3 +23,29 @@ Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Securit * **Deploy**: Use this button to deploy all of the XML and CIP files you selected on the system.
+ +## Configuration Details for Signed Deployment + +
+ +AppControl Manager Application's Content Dialog for Policy Signing details + +
+ +
+ +
+ +When signing and deploying App Control Policies, a dialog will be displayed asking for additional information required for signing the policy. + +* **Certificate File**: Provide the path to the certificate `.cer` file. It must be a code signing certificate that is either issued by a public certificate authority (CA) or a self-signed certificate. You can generate a self-signed certificate suitable for App Control policy signing in [the certificate building page](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Build-New-Certificate) of the AppControl Manager. The certificate's details will be added to the XML policy as signers. The certificate must exist in the Personal store of the Current User certificate stores with private key. + +* **Certificate Common Name**: The Common Name (CN) of the same certificate file you select. + +* **SignTool Path**: The path to the `SignTool.exe`. If you don't have it, you can toggle the **Auto Acquire** switch. Auto Acquire will try to first find it on the system by checking for installed Windows SDK, if it cannot find it, it will download it from the official Microsoft server. + +Once you've provided all 3 items, press the **Verify** button. It will verify your inputs and then the **Submit** button will be enabled, allowing you to proceed with policy signing and deployment. + +All of the information you submit will be saved in app settings so that the next time they will be automatically populated for you. + +
diff --git a/Wiki posts/AppControl Manager/Get Code Integrity Hashes.md b/Wiki posts/AppControl Manager/Get Code Integrity Hashes.md index aaaaa39bc..af8f5d920 100644 --- a/Wiki posts/AppControl Manager/Get Code Integrity Hashes.md +++ b/Wiki posts/AppControl Manager/Get Code Integrity Hashes.md @@ -1,7 +1,20 @@ # Get Code Integrity Hashes +
+ +AppControl Manager Application's Get Code Integrity Hashes Page + +
+ +
+ +
+ Use this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page to calculate Code Integrity hashes of the files. Code Integrity hashes are those that the Code Integrity in Windows primarily uses: SHA1 and SHA2-256 1st page hashes, SHA1 and SHA2-256 Authenticode hashes. Use the browser button to select a file and the hashes will be immediately calculated and displayed on the page. +> [!NOTE]\ +> If the selected file is non-conformant, the app will calculate the flat hashes of the file and present them as Authenticode hashes. When that happens, the page hashes will be displayed as `N/A`. This is compliant with how the App Control engine in Windows works. +
diff --git a/Wiki posts/AppControl Manager/Get Secure Policy Settings.md b/Wiki posts/AppControl Manager/Get Secure Policy Settings.md index 068b41fd9..bd4f9c880 100644 --- a/Wiki posts/AppControl Manager/Get Secure Policy Settings.md +++ b/Wiki posts/AppControl Manager/Get Secure Policy Settings.md @@ -1,5 +1,15 @@ # Get Secure Policy Settings +
+ +AppControl Manager Application's Get Secure Policy Settings Page + +
+ +
+ +
+ In this [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) page, you can verify whether a policy with certain secure settings is deployed on the system or not. App Control for Business policies expose a Settings section where policy authors can define arbitrary secure settings. Secure Settings provide local admin tamper-free settings for secure boot enabled systems, with policy signing enabled. [Learn more about them in here.](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/understanding-appcontrol-policy-settings) @@ -43,6 +53,6 @@ Set-CIPolicySetting -FilePath 'Policy.xml' -Provider 'Provider2' -ValueType 'DWo * `DWord` value is the same as integer or `WldpInteger`. * In order to set a Boolean value using the `Set-CIPolicySetting` cmdlet, you need to use 1 for True or 0 for False, that will create a valid policy XML file that is compliant with the CI Policy Schema. - +
diff --git a/Wiki posts/AppControl Manager/Merge App Control Policies.md b/Wiki posts/AppControl Manager/Merge App Control Policies.md index 7b44d8a18..204313fab 100644 --- a/Wiki posts/AppControl Manager/Merge App Control Policies.md +++ b/Wiki posts/AppControl Manager/Merge App Control Policies.md @@ -1,5 +1,15 @@ # Merge App Control Policies +
+ +AppControl Manager Application's Merge App Control Policies Page + +
+ +
+ +
+ Use the Merge page in the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to combine multiple App Control policies into a single, unified policy. This is especially useful when you want to consolidate multiple policies into one. During the merge process, duplicate rules are automatically removed. You can even select the same policy as both the main source and the merge source to eliminate duplicate rules within a single policy. Additionally, this feature generates astronomically unique IDs for each entry in the policy XML file, utilizing double GUID [version 7](https://www.rfc-editor.org/rfc/rfc9562.html#name-uuid-version-7) for maximum uniqueness. Keep in mind that the length of the IDs do not affect the generated CIP file's size. diff --git a/Wiki posts/AppControl Manager/Sidebar.md b/Wiki posts/AppControl Manager/Sidebar.md index c08f42971..1299e8114 100644 --- a/Wiki posts/AppControl Manager/Sidebar.md +++ b/Wiki posts/AppControl Manager/Sidebar.md @@ -1,8 +1,18 @@ # Sidebar +
+ +AppControl Manager Application's Sidebar + +
+ +
+ +
+ The [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) features a versatile Sidebar designed to streamline user interactions and enhance productivity. With the Sidebar, you can select a base policy path once and seamlessly reuse it throughout the app, eliminating the need to repeatedly browse for the file. -Pages within AppControl Manager that require an XML policy file automatically recognize when a path has been selected in the Sidebar. As you navigate to these pages, subtle indicators appear, prompting you to open the Sidebar and quickly access the pre-selected file path. +Pages within AppControl Manager that require an XML policy file automatically recognize when a path has been selected in the Sidebar. As you navigate to these pages, subtle indicators appear , prompting you to open the Sidebar and quickly access the pre-selected file path. The Sidebar also includes a toggle switch that, when enabled, automatically assigns newly created base policy paths to the Sidebar. This feature further accelerates workflow and minimizes manual input. diff --git a/Wiki posts/AppControl Manager/Simulation.md b/Wiki posts/AppControl Manager/Simulation.md index c9ea2cc97..112997a72 100644 --- a/Wiki posts/AppControl Manager/Simulation.md +++ b/Wiki posts/AppControl Manager/Simulation.md @@ -1,5 +1,15 @@ # Simulation +
+ +AppControl Manager Application's Simulation Page + +
+ +
+ +
+ The Simulation page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) allows you to simulate an App Control for Business policy deployment. Simply select folders or files and a policy XML file, it will show you whether the selected files would be allowed or blocked by your App Control policy if it was actually deployed on a system and those files were running. There will be very detailed results of each file that participates in the Simulation process. You can use sorting and search features to categories and find the files quickly. diff --git a/Wiki posts/AppControl Manager/System Information.md b/Wiki posts/AppControl Manager/System Information.md index f762b3a39..589b99fac 100644 --- a/Wiki posts/AppControl Manager/System Information.md +++ b/Wiki posts/AppControl Manager/System Information.md @@ -1,12 +1,22 @@ # System Information -Use the System Information page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to view details about the deployed App Control policies on the system. +
+ +AppControl Manager Application's System Information Page + +
+ +
+ +
+ +Use the System Information page in [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to view details about the deployed App Control policies on the system. * Search through the list of policies * View the rule options in each policy -* Determine which policy is signed or unsigned +* Determine which policy is signed or unsigned (requires Windows 11 24H2 or later/Windows Server 2025 or later, otherwise all policies will appear as `unsigned` regardless of their actual signing status) * Sort the policies using multiple criteria @@ -21,18 +31,68 @@ Use the System Information page in [AppControl Manager](https://github.com/HotCa
-This page also allows you to **remove** the deployed App Control policies from the system with a single click/tap. +## View Code Integrity Information -In the ***Code Integrity Information*** section you can view advanced details about the current status of Code Integrity on the system. +In the ***Code Integrity Information*** section you can view advanced details about the current status of Code Integrity on the system. You can also check the status of Application Control for Business, including whether User-Mode or Kernel-Mode policies are deployed and whether they are set to Enforced mode or Audit mode. +
+ +## Policy Removal + +This page also allows you to **remove** the deployed non-system App Control policies from the system. + +Whenever you select a policy from the list, the app will automatically present to you the best and most appropriate course of action in order to remove it. + +
+ +### Removing Unsigned or Supplemental Policies + +Unsigned Base or signed/unsigned Supplemental Application Control policies can be removed with a single click/tap of a button. Simply select a policy from the list and then use the **Remove** button to remove it. + +Starting with Windows 11 24H2/Windows Server 2025, no reboot is required for unsigned base or supplemental policies. + +
+ +### Removing Signed Base Policies + +Signed Base policies require additional information during the removal process. Select a signed policy and then press the **Remove** button, you will be presented with a dialog asking for additional information. + + +
+ +AppControl Manager Application Signed Base policy removal dialog + +
+ +
+ +
+ +* **Certificate File**: Provide the path to the certificate `.cer` file. The certificate's details must exist in the XML policy file as signers, so ensure it is the same certificate that you used to sign the policy with. The certificate must exist in the Personal store of the Current User certificate stores with private key. + +* **Certificate Common Name**: The Common Name (CN) of the same certificate file you select. + +* **SignTool Path**: The path to the `SignTool.exe`. If you don't have it, you can toggle the **Auto Acquire** switch. Auto Acquire will try to first find it on the system by checking for installed Windows SDK, if it cannot find it, it will download it from the official Microsoft server. + +* **XML File**: The path to the XML policy file of the same policy you're trying to remove from the system. + +Once all four fields are populated, press the **Verify** button. This action validates your inputs and enables the **Submit** button, allowing you to proceed with the removal process. All of the information you submit will be saved in app settings so that the next time they will be automatically populated for you. + +Following this step, the policy will be re-signed and redeployed on the system with a new [rule option](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options) labeled **Enabled: Unsigned System Integrity Policy**. + +> [!IMPORTANT]\ +> After completing this process, restart your system. Since signed policies are tamper-resistant, they leverage Secure Boot and reside in the EFI partition. Upon reboot, select the same signed policy and press the Remove **button**. The AppControl Manager will detect the policy as safe for removal and delete it from the system without requiring further input. (**If you do not reboot your system and attempt to remove the signed policy that was just re-signed and re-deployed, it will lead to boot failure.**) + +
+ > [!NOTE]\ > **About the Automatic Policies filter option** > > Enabling this checkbox includes supplemental policies named `AppControlManagerSupplementalPolicy` in the displayed results. Each base policy created and deployed via the AppControl Manager automatically deploys a corresponding supplemental policy with this name. This supplemental policy is essential for the operation of the AppControl Manager application itself. > In addition, it contains a FilePublisher rule for `SignTool.exe`, allowing signing operations to be performed. If you intentionally remove this policy, you will no longer be able to launch the AppControl Manager or use `SignTool.exe` when certain base policies are active. -> +> > **Note that these supplemental policies are automatically removed when their associated base policy is removed from the system, so no additional action is required on your part.** > > You can view the XML source of the `AppControlManagerSupplementalPolicy` supplemental policy [here](https://github.com/HotCakeX/Harden-Windows-Security/blob/main/AppControl%20Manager/Resources/AppControlManagerSupplementalPolicy.xml). diff --git a/Wiki posts/AppControl Manager/Update.md b/Wiki posts/AppControl Manager/Update.md index 630bac718..5ccbffebc 100644 --- a/Wiki posts/AppControl Manager/Update.md +++ b/Wiki posts/AppControl Manager/Update.md @@ -1,5 +1,15 @@ # Update +
+ +AppControl Manager Application's Update Page + +
+ +
+ +
+ In the [AppControl Manager's](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) update page you can configure the app to automatically check for updates at startup. Alternatively, you can manually check for updates or customize the update behavior to use a hardened update procedure for enhanced security. Additionally, you can select an MSIX package to install as an update for AppControl Manager. This feature is particularly useful if you've already downloaded the MSIX file from GitHub or built the application from the source code yourself. diff --git a/Wiki posts/Home Index.md b/Wiki posts/Home Index.md index 834381a93..99b7851a9 100644 --- a/Wiki posts/Home Index.md +++ b/Wiki posts/Home Index.md @@ -34,13 +34,11 @@ ## [App Control for Business](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction) - [Introduction](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction) -- [App Control for Lightly Managed Devices](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Lightly-Managed-Devices) -- [App Control for Fully managed device - Variant 1](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Fully-Managed-Devices) -- [App Control for Fully managed device - Variant 2](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Fully-Managed-Devices--Variant-2) -- [App Control for Fully managed device - Variant 3](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-Fully-managed-device---Variant-3) -- [App Control for Fully managed device - Variant 4](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-Fully-managed-device---Variant-4) +- [How To Generate Audit Logs via App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Generate-Audit-Logs-via-App-Control-Policies) +- [How To Create an App Control Supplemental Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Create-an-App-Control-Supplemental-Policy) +- [The Strength of Signed App Control Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/The-Strength-of-Signed-App-Control-Policies) - [App Control Notes](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes) -- [How to Create and Deploy a Signed App Control Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control) +- [How to use Windows Server to Create App Control Code Signing Certificate](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control) - [Fast and Automatic Microsoft Recommended Driver Block Rules updates](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Fast-and-Automatic-Microsoft-Recommended-Driver-Block-Rules-updates) - [App Control policy for BYOVD Kernel mode only protection](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) - [EKUs in App Control for Business Policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/EKUs-in-WDAC,-App-Control-for-Business,-Policies) diff --git a/Wiki posts/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus.md b/Wiki posts/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus.md index bcd5a5ab8..d1d5d23e3 100644 --- a/Wiki posts/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus.md +++ b/Wiki posts/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus.md @@ -138,6 +138,8 @@ Application control is a crucial line of defense for protecting computer systems * [Read More](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction) +* [**AppControl Manager**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) +
### Complete BYOVD Protection @@ -152,8 +154,6 @@ This scenario involves removing the trust to any Kernel mode driver, whether the Implements Sandboxing-like restrictions around the program's dependencies so that only the main executable(s) of the program can use its dependencies and any other executable will be blocked from using them. -* [Read More](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-WDACConfig#-boostedsecurity) - * [Watch](https://youtu.be/cp7TaTNPZE0?si=2rhBTGdO76A5vQS6)
diff --git a/Wiki posts/WDACConfig Module Main/Assert-WDACConfigIntegrity.md b/Wiki posts/WDACConfig Module Main/Assert-WDACConfigIntegrity.md deleted file mode 100644 index c04895b76..000000000 --- a/Wiki posts/WDACConfig Module Main/Assert-WDACConfigIntegrity.md +++ /dev/null @@ -1,60 +0,0 @@ -# Assert-WDACConfigIntegrity available parameters - -![Assert-WDACConfigIntegrity demo](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Assert-WDACConfigIntegrity/Assert-WDACConfigIntegrity.gif) - -## Syntax - -```powershell -Assert-WDACConfigIntegrity - [-SaveLocally] - [-Path ] - [] -``` - -## Description - -This cmdlet scans all of the relevant files in the WDACConfig module's folder and computes their SHA2-512 hashes. - -Then it downloads the [cloud CSV file](https://github.com/HotCakeX/Harden-Windows-Security/blob/main/WDACConfig/Utilities/Hashes.csv) from the GitHub repository and compares the hashes of the local files with the ones in the cloud. - -By doing so, you can ascertain that the files in your local WDACConfig folder are identical to the ones in the cloud and devoid of any interference. - -If there is any indication of tampering, the outcomes will be displayed on the console. - -## Parameters - -### -SaveLocally - -This parameter is used to generate hashes of the final module's files prior to publishing them to the GitHub. This parameter shouldn't be used. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Path - -Can define a different path for the `Hashes.csv` file. This parameter shouldn't be used. - -
- -| Type: |[DirectoryInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.directoryinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | Module's Root Directory | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Build-WDACCertificate.md b/Wiki posts/WDACConfig Module Main/Build-WDACCertificate.md deleted file mode 100644 index 1db46c67b..000000000 --- a/Wiki posts/WDACConfig Module Main/Build-WDACCertificate.md +++ /dev/null @@ -1,154 +0,0 @@ -# Build-WDACCertificate available parameters - -![Build-WDACCertificate demo](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Build-WDACCertificate/Build-WDACCertificate.gif) - -## Syntax - -```powershell -Build-WDACCertificate - [[-CommonName] ] - [[-FileName] ] - [[-BuildingMethod] ] - [[-Password] ] - [-Force] - [] -``` - -## Description - -This cmdlet constructs self-signed certificates that adhere to [Microsoft's specifications](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/use-signed-policies-to-protect-appcontrol-against-tampering) for WDAC policy signing. With this cmdlet, you can dispense with [Windows Server with a CA role](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control) to generate a certificate. - -The generated certificates type is Code Signing, they employ `SHA2-512` hashing algorithm with `RSA 4096-bit` encryption (the maximum supported key size for WDAC signing.) - -Upon constructing a certificate, the cmdlet stores it in the Current User's personal store, then it exports that certificate in 2 files. One of the files has a `.cer` extension and encompasses only the public key, the other file has a `.pfx` extension and encompasses both public and private keys. - -The PFX file is encrypted with `SHA-256` encryption and safeguarded with the password supplied by the user. After the 2 files are exported, the cmdlet eliminates the certificate from Current Users personal store and then re-imports it using the PFX file, but this time it will store the private key using [VSM](https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm) (Virtual Secure Mode). In this method, the private keys are stored in the TPM and are highly secured with [VBS](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs) (Virtualized-Based Security). The entire process happens in just few seconds. - -## Parameters - -### -CommonName - -The common name of the certificate, it will also be assigned as the friendly name of the certificate. - -> [!TIP]\ -> If you enter a CommonName but do not enter a FileName, the FileName will be set to the same value as the CommonName for better user experience. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `Code Signing Certificate` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -FileName - -The name of the `.cer` and `.pfx` files that will be generated. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `Code Signing Certificate` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -BuildingMethod - -2 methods are used to build the certificates. Method 1 uses the [Certreq](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certreq_1) and the Method 2 uses the [New-SelfSignedCertificate](https://learn.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate). - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `Method2` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Password - -The password to be employed to encrypt the `.pfx` file that encompasses the private and public keys of the certificate. It necessitates being in Secure String type. If it’s not supplied, the user will be prompted to input a password (and a second time to verify it). The minimum password length is 5 characters. - -
- -| Type: |[SecureString](https://learn.microsoft.com/en-us/dotnet/api/system.security.securestring)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Force - -The cmdlet verifies whether there is any certificate with the identical common name as the certificate that is being created, on the system. If it detects one, it will prompt the user to for permission to remove them. If this parameter is employed, the prompt will be omitted as it will presume that the user acquiesced. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -#### Related Resources - -* [X500NameFlags enumeration](https://learn.microsoft.com/en-us/windows/win32/api/certenroll/ne-certenroll-x500nameflags?redirectedfrom=MSDN) -* [Local Machine and Current User Certificate Stores](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/local-machine-and-current-user-certificate-stores) -* [Trusted Root Certification Authorities Certificate Store](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/trusted-root-certification-authorities-certificate-store) -* [X509BasicConstraintsExtension Class](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509basicconstraintsextension) -* [Internet X.509 Public Key Infrastructure Certificate and CRL Profile - RFC2459](https://www.rfc-editor.org/rfc/rfc2459) - -
- -## Additional Resources - -To enhance the security and safeguarding of your certificate further, you can remove the certificate from the Personal store of the Current User certificates and then utilize the PFX file to import it anew in the same location, but this time you will mark additional boxes in the import wizard. - -This video illustrates how to safeguard the Code Signing Certificate generated by the WDACConfig module, so that you will be compelled to either enter your security password or verify your identity every time the certificate is employed. By storing the certificate in this manner, only your user account will have access to it, and you will inherently possess administrator privileges to implement the signed App Control policy on the system. - -These options are only accessible in GUI and they are to deter automatic scripts from utilizing the certificates without authentication, this is why the `Build-WDACCertificate` cmdlet does not activate this security feature by default. - -
- -
- -How to safely store the App Control Code Signing Certificate in Windows WDACConfig module thumbnail - -
- -
- -## HSM (Hardware Security Module) - -The most secure method of storing code signing certificates is to use a hardware security module (HSM) or a similar device. Furthermore, obtaining certificates from a regulated or publicly trusted certificate authority (CA) requires the use of an HSM. The HSMs must also comply with the Federal Information Processing Standards (FIPS). - -
diff --git a/Wiki posts/WDACConfig Module Main/Confirm-WDACConfig.md b/Wiki posts/WDACConfig Module Main/Confirm-WDACConfig.md deleted file mode 100644 index a8c05fed7..000000000 --- a/Wiki posts/WDACConfig Module Main/Confirm-WDACConfig.md +++ /dev/null @@ -1,117 +0,0 @@ -# Confirm-WDACConfig available parameters - -## Confirm-WDACConfig -ListActivePolicies - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Confirm-WDACConfig/Confirm-WDACConfig%20-ListActivePolicies.apng) - -## Syntax - -```powershell -Confirm-WDACConfig - [-ListActivePolicies] - [-OnlyBasePolicies] - [-OnlySupplementalPolicies] - [-OnlySystemPolicies] -``` - -## Description - -Lists the deployed Base and Supplemental App Control Policies using [CITool](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/citool-commands) and displays their counts and details. - -## Parameters - -### -OnlyBasePolicies - -Using this will only display Base policies. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -OnlySupplementalPolicies - -Using this will only display Supplemental policies. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -OnlySystemPolicies - -Using this will only display system policies. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -horizontal super thin rainbow RGB line - -
- -## Confirm-WDACConfig -VerifyWDACStatus - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Confirm-WDACConfig/Confirm-WDACConfig%20-VerifyWDACStatus.apng) - -## Syntax - -```powershell -Confirm-WDACConfig - [-VerifyWDACStatus] -``` - -## Description - -Shows the [status](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes#how-to-verify-the-status-of-user-mode-and-kernel-mode-wdac-on-a-system) of User-mode and Kernel-mode application control. - -
- -horizontal super thin rainbow RGB line - -
- -## Confirm-WDACConfig -CheckSmartAppControlStatus - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Confirm-WDACConfig/Confirm-WDACConfig%20-CheckSmartAppControlStatus.apng) - -## Syntax - -```powershell -Confirm-WDACConfig - [-CheckSmartAppControlStatus] -``` - -## Description - -Checks the status of Smart App Control and reports the results on the console, including the evaluation mode expiration date. - -
diff --git a/Wiki posts/WDACConfig Module Main/Deploy-SignedWDACConfig.md b/Wiki posts/WDACConfig Module Main/Deploy-SignedWDACConfig.md deleted file mode 100644 index cf76612a8..000000000 --- a/Wiki posts/WDACConfig Module Main/Deploy-SignedWDACConfig.md +++ /dev/null @@ -1,142 +0,0 @@ -# Deploy-SignedWDACConfig available parameters - -
-How to sign and deploy signed App Control policies
- -
- -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Deploy-SignedWDACConfig/Deploy-SignedWDACConfig.apng) - -## Syntax - -```powershell -Deploy-SignedWDACConfig - -PolicyPaths - [-Deploy] - [-CertPath ] - [-CertCN ] - [-SignToolPath ] - [-Force] - [-Confirm] - [] -``` - -## Description - -Creates and signs a `.CIP` file that can be either deployed locally using the `-Deploy` parameter or you can deploy the signed policy binary on a different machine later using the built-in [Citool](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/citool-commands), Intune etc. - -## Parameters - -### -PolicyPaths - -The XML Policies to deploy. Supports File picker GUI. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CertPath - -Path to the certificate `.cer` file. Press TAB to open the file picker GUI and browse for a `.cer` file. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CertCN - -Common name of the certificate - Supports argument completion so you don't have to manually enter the Certificate's CN, just make sure the `-CertPath` is specified and the certificate is installed in the personal store of the user certificates, then press TAB to auto complete the name. You can however enter it manually if you want to. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SignToolPath - -Press TAB to open the file picker GUI and browse for SignTool.exe - -> [!IMPORTANT]\ -> Refer [to this section](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#the-logic-behind-the--signtoolpath-parameter-in-the-module) for more info - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Deploy - -Deploys the signed policy on the system - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Force - -Indicates that the cmdlet won't ask for confirmation and will proceed with deploying the signed policy. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Edit-SignedWDACConfig.md b/Wiki posts/WDACConfig Module Main/Edit-SignedWDACConfig.md index 3abf156a9..ff5aa6f39 100644 --- a/Wiki posts/WDACConfig Module Main/Edit-SignedWDACConfig.md +++ b/Wiki posts/WDACConfig Module Main/Edit-SignedWDACConfig.md @@ -2,8 +2,6 @@ ## Edit-SignedWDACConfig -AllowNewApps -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Edit-SignedWDACConfig/Edit-SignedWDACConfig%20-AllowNewApps.apng) - ## Syntax ```powershell @@ -281,8 +279,6 @@ By default, the module includes user PEs in the scan. When you use this switch p ## Edit-SignedWDACConfig -MergeSupplementalPolicies -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Edit-SignedWDACConfig/Edit-SignedWDACConfig%20-MergeSupplementalPolicies.apng) - ## Syntax ```powershell @@ -442,8 +438,6 @@ Indicates that the module will not remove the old Supplemental policy xml files ## Edit-SignedWDACConfig -UpdateBasePolicy -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Edit-SignedWDACConfig/Edit-SignedWDACConfig%20-UpdateBasePolicy.apng) - ## Syntax ```powershell diff --git a/Wiki posts/WDACConfig Module Main/Edit-WDACConfig.md b/Wiki posts/WDACConfig Module Main/Edit-WDACConfig.md deleted file mode 100644 index 586873b9f..000000000 --- a/Wiki posts/WDACConfig Module Main/Edit-WDACConfig.md +++ /dev/null @@ -1,188 +0,0 @@ -# Edit-WDACConfig available parameters - -## Edit-WDACConfig -MergeSupplementalPolicies - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Edit-WDACConfig/Edit-WDACConfig%20-MergeSupplementalPolicies.apng) - -## Syntax - -```powershell -Edit-WDACConfig - [-MergeSupplementalPolicies] - -SuppPolicyName - [-PolicyPath ] - -SuppPolicyPaths - [-KeepOldSupplementalPolicies]s - [] -``` - -## Description - -Merge multiple deployed Supplemental policies into 1 and deploy it, remove the individual ones, all happening automatically. - -## Parameters - -### -SuppPolicyName - -Choose a descriptive name for the Supplemental policy that is going to be the merge of multiple policies. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SuppPolicyPaths - -Path to the Supplemental policies xml files. Supports argument tab completion by showing only Supplemental policy types. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -PolicyPath - -Path to the Base policy xml file the Supplemental policies belong to. Supports argument tab completion by showing only Base policy types. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -KeepOldSupplementalPolicies - -Indicates that the module will not remove the old Supplemental policy xml files after creating and deploying the new merged one. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -horizontal super thin rainbow RGB line - -
- -## Edit-WDACConfig -UpdateBasePolicy - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Edit-WDACConfig/Edit-WDACConfig%20-UpdateBasePolicy.apng) - -## Syntax - -```powershell -Edit-WDACConfig - [-UpdateBasePolicy] - -CurrentBasePolicyName - -NewBasePolicyType - [-RequireEVSigners] - [] -``` - -## Description - -It can rebootlessly change the type or rule options of the deployed base policy. The deployed Supplemental policies will stay intact and continue to work with the new Base policy. - -> [!NOTE]\ -> When switching from a more permissive base policy type to a more restrictive one, make sure your Supplemental policies will continue to work. E.g., if your current base policy type is *AllowMicrosoft* and the one you are switching to is *DefaultWindows*, there *might* be files that will get blocked as a result of this switch. -> -> That's simply because they were allowed by the more permissive *AllowMicrosoft* policy type so they didn't trigger audit logs (in case the supplemental policy was created based on audit logs) thus weren't needed to be included in the Supplemental policy. You will need to update those Supplemental policies if that happens by deleting and recreating them, no immediate reboot required. - -## Parameters - -### -CurrentBasePolicyName - -The name of the currently deployed base policy. It supports tab completion so just press tab to autofill it. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -NewBasePolicyType - -The new type of the base policy to deploy. It supports tab completion so just press tab to autofill it. Supports all 3 main Base policy types. - -> [!NOTE]\ -> If the selected policy type is `DefaultWindows` and the detected PowerShell is not installed through Microsoft Store, the module will scan the PowerShell files and add them to the `DefaultWindows` base policy as allowed files so you will be able to continue using the module after deploying the policy. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Accepted values: | `AllowMicrosoft`, `DefaultWindows`, `SignedAndReputable` | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -RequireEVSigners - -Indicates that the created/deployed policy will have [Require EV Signers](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-create-base-policy#advanced-policy-rules-description) policy rule option. - -* In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later, or Windows 11 drivers will meet this requirement. - -
- -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Get-CIPolicySetting.md b/Wiki posts/WDACConfig Module Main/Get-CIPolicySetting.md deleted file mode 100644 index faae119e8..000000000 --- a/Wiki posts/WDACConfig Module Main/Get-CIPolicySetting.md +++ /dev/null @@ -1,86 +0,0 @@ -# Get-CIPolicySetting available parameters - -
-How To Set And Query Secure Settings in App Control Policies
- -## Syntax - -```powershell -Get-CIPolicySetting - [-Provider] - [-Key] - [-ValueName] - [] -``` - -## Description - -Gets the secure settings value from the deployed CI policies. If there is a policy with the same provider, key and value then it returns the following details: - -
- -| Property | Description | -| :-------------: | :-------------: | -| Value | The actual value of the string | -| ValueType | The type of setting: `WldpString`, `WldpInteger` or `WldpBoolean` | -| ValueSize | the size of the returned value | -| Status | True/False depending on whether the setting exists on the system or not | -| StatusCode | 0 if the value exists on the system, non-zero if it doesn't. | - -
- -## Parameters - -### -Provider - -The provider of the secure setting. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Key - -The key of the secure setting. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -ValueName - -The name of the secure setting. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Get-CiFileHashes.md b/Wiki posts/WDACConfig Module Main/Get-CiFileHashes.md deleted file mode 100644 index 3782c1aba..000000000 --- a/Wiki posts/WDACConfig Module Main/Get-CiFileHashes.md +++ /dev/null @@ -1,42 +0,0 @@ -# Get-CiFileHashes available parameters - -![Get-CiFileHashes demo](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Get-CiFileHashes/Get-CiFileHashes%20-FilePath.gif) - -## Syntax - -```powershell -Get-CiFileHashes - [-FilePath] - [] -``` - -## Description - -Calculates the Authenticode hash and first page hash of the PEs with SHA1 and SHA256 algorithms. The hashes are compliant with the App Control for Business policy. - -The cmdlet outputs an ordered hashtable. The keys are the hash algorithm names and the values are the hashes. - -For more information please visit [this page](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#more-information-about-hashes) - -> [!NOTE]\ -> If the file is non-conformant, the function will calculate the flat hash of the file using the specified hash algorithm and return them as the Authenticode hashes. This is compliant with how the App Control engine in Windows works. - -## Parameters - -### -FilePath - -The path to the file for which the hashes are to be calculated. Supports TAB completion, when you press Tab key, file picker GUI will open allowing you to select a file. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Get-CommonWDACConfig.md b/Wiki posts/WDACConfig Module Main/Get-CommonWDACConfig.md deleted file mode 100644 index 075ad20f6..000000000 --- a/Wiki posts/WDACConfig Module Main/Get-CommonWDACConfig.md +++ /dev/null @@ -1,17 +0,0 @@ -# Get-CommonWDACConfig available parameters - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Get-CommonWDACConfig/Get-CommonWDACConfig.apng) - -## Syntax - -```powershell -Get-CommonWDACConfig -``` - -## Description - -Use this cmdlet to query and display the values for common and frequently used parameters in the User Configurations Json file. - -All of the applicable cmdlets of the module automatically check the User Configuration file for any available input, if you don't specify values for their parameters. Learn more about the User Configuration file [here](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters). - -
diff --git a/Wiki posts/WDACConfig Module Main/Invoke-WDACSimulation.md b/Wiki posts/WDACConfig Module Main/Invoke-WDACSimulation.md deleted file mode 100644 index ab81d2ef7..000000000 --- a/Wiki posts/WDACConfig Module Main/Invoke-WDACSimulation.md +++ /dev/null @@ -1,248 +0,0 @@ -# Invoke-WDACSimulation available parameters - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Invoke-WDACSimulation/Invoke-WDACSimulation.apng) - -Simulating Application Control Deployment in Windows - -## Syntax - -```powershell -Invoke-WDACSimulation - [-XmlFilePath] - [[-FolderPath] ] - [[-FilePath] ] - [-BooleanOutput] - [-CSVOutput] - [-Log] - [-NoCatalogScanning] - [[-CatRootPath] ] - [[-ThreadsCount] ] - [] -``` - -## Description - -This cmdlet allows you to simulate an App Control for Business policy deployment. Simply select folders or files and a policy XML file, it will show you whether the selected files would be allowed or blocked by your App Control policy if it was actually deployed on a system and those files were run. - -
- -## Supported Levels and SpecificFileNameLevel Options - -* The App Control Simulation engine **supports** the following [levels](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Rule-Levels-Comparison-and-Guide): - - * WHQLFilePublisher - * WHQLPublisher - * WHQL - * FilePublisher - * Publisher - * SignedVersion - * PCA Certificate - * Root Certificate - * Leaf Certificate - * Hash - * FilePath - -* The engine **supports** all of the [SpecificFileNameLevel](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-3--specificfilenamelevel-options) options when validating the FilePublisher level. - - * FileDescription - * InternalName - * OriginalFileName - * PackageFamilyName - * ProductName - * Filepath - -* The Simulation engine *doesn't support* the following [level](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Rule-Levels-Comparison-and-Guide#--filename) yet (they will be added in a future update): - - * FileName - -
- -## Accuracy - -* The engine can determine with 100% accuracy whether a file is authorized by a given policy or not as long as the file was scanned based on one of the supported levels mentioned above. - -
- -## Some Use Cases - -* Have an App Control policy and you want to test whether all of the files of a program will be allowed by the policy without running the program first? Use this App Control simulation to find out. - -* Employ this simulation method to discover files that are not explicitly specified in the App Control policy but are still authorized to run by it. - -* Identify files that have hash mismatch and will not be permitted by App Control engine using signature. These files are typically found in [*questionable* software](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes#allowing-questionable-software-in-a-wdac-policy) because they are tampered with. - -* And many more. - -## Parameters - -### -XmlFilePath - -Path to a xml file. Supports argument tab completion, select the parameter then press TAB to open the file picker GUI that only shows xml files. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -FolderPath - -Path to folders. Supports argument tab completion, select the parameter then press TAB to open the Folder picker GUI. - -
- -| Type: |[DirectoryInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.directoryinfo)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -FilePath - -Provide path to files that you want App Control simulation to run against - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -BooleanOutput - -Can be used with any parameter to return a boolean value instead of displaying the object output. If any of the selected files or any of the files in the selected folders are not authorized by the selected XML file, the result is `$false`. Otherwise, the result is `$true`. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CSVOutput - -Upon completion of the simulation, you will obtain a CSV file containing the output of the simulation with exhaustive details of each file that would be blocked/allowed by the selected policy, and which rule or signer in the XML policy is responsible for the decision. - -It is saved in the WDACConfig folder in `C:\Program Files\WDACConfig` - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Log - -Use this switch to start a transcript of the App Control simulation and log everything displayed on the screen. - -The log file is saved in the WDACConfig folder in `C:\Program Files\WDACConfig` - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CatRootPath - -Provide path(s) to directories where security catalog `.cat` files are located. If not provided, the default path is `C:\Windows\System32\CatRoot`. Supports argument tab completion, select the parameter then press TAB to open the Folder picker GUI. - -
- -| Type: |[DirectoryInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.directoryinfo)[]| -| :-------------: | :-------------: | -| Aliases: | Cat | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -NoCatalogScanning - -Bypass the scanning of the security catalogs on the system. It can make the scan results less accurate. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -ThreadsCount - -The number of the concurrent/parallel tasks to use when performing App Control Simulation. - -* Max is the number of your system's CPU cores. -* Min is 1. -* If you enter a number higher than your system's CPU cores, it will be set to your system's CPU cores count. - -
- -| Type: |[UInt32](https://learn.microsoft.com/en-us/dotnet/api/system.uint32)| -| :-------------: | :-------------: | -| Aliases: | CPU | -| Position: | Named | -| Default value: | 2 | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/New-DenyWDACConfig.md b/Wiki posts/WDACConfig Module Main/New-DenyWDACConfig.md index 78df01ca6..4258d0b6f 100644 --- a/Wiki posts/WDACConfig Module Main/New-DenyWDACConfig.md +++ b/Wiki posts/WDACConfig Module Main/New-DenyWDACConfig.md @@ -1,184 +1,7 @@ # New-DenyWDACConfig available parameters -## New-DenyWDACConfig -Normal - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-DenyWDACConfig/New-DenyWDACConfig%20-Normal.apng) - -## Syntax - -```powershell -New-DenyWDACConfig - [-Normal] - -PolicyName - [-ScanLocations ] - [-Deploy] - [-Level ] - [-Fallbacks ] - [-SpecificFileNameLevel ] - [-NoUserPEs] - [-NoScript] - [] -``` - -## Description - -Creates a Deny base policy by scanning a directory. The base policy will have 2 allow all rules, meaning it can be deployed as a standalone base policy, side-by-side any other Base/Supplemental policies. - -## Parameters - -### -PolicyName - -Add a descriptive name for the Deny base policy. Accepts only alphanumeric and space characters. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -ScanLocations - -Accepts one or more comma separated folder paths. Supports argument completion, when you press tab, folder picker GUI will open allowing you to easily select a folder, you can then add a comma `,` and press tab again to select another folder path or paste a folder path manually, works both ways. - -
- -| Type: |[DirectoryInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.directoryinfo)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Deploy - -Indicates that the module will automatically deploy the Deny base policy after creation. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Levels - -Offers the same official [Levels](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-level) to scan the specified directory path(s). - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `WHQLFilePublisher` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Fallbacks - -Offers the same official [Fallbacks](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-fallback) to scan the specified directory path(s). - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `FilePublisher`,`Hash` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SpecificFileNameLevel - -[More info available on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-specificfilenamelevel) - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Accepted values: | `OriginalFileName`, `InternalName`, `FileDescription`, `ProductName`, `PackageFamilyName`, `FilePath` | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -NoUserPEs - -By default the module includes user PEs in the scan, but when you use this switch parameter, they won't be included. [More info available on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-userpes) - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -NoScript - -[More info available on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-noscript) - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -horizontal super thin rainbow RGB line - -
- ## New-DenyWDACConfig -Drivers -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-DenyWDACConfig/New-DenyWDACConfig%20-Drivers.apng) - ## Syntax ```powershell @@ -260,8 +83,6 @@ Indicates that the module will automatically deploy the Deny base policy after c ## New-DenyWDACConfig -InstalledAppXPackages -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-DenyWDACConfig/New-DenyWDACConfig%20-InstalledAppXPackages.apng) - ## Syntax ```powershell diff --git a/Wiki posts/WDACConfig Module Main/New-KernelModeWDACConfig.md b/Wiki posts/WDACConfig Module Main/New-KernelModeWDACConfig.md index 8395c7951..a078d91fa 100644 --- a/Wiki posts/WDACConfig Module Main/New-KernelModeWDACConfig.md +++ b/Wiki posts/WDACConfig Module Main/New-KernelModeWDACConfig.md @@ -1,5 +1,4 @@ # New-KernelModeWDACConfig available parameters -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-KernelModeWDACConfig/New-KernelModeWDACConfig%20-Default.apng) ## Syntax diff --git a/Wiki posts/WDACConfig Module Main/New-SupplementalWDACConfig.md b/Wiki posts/WDACConfig Module Main/New-SupplementalWDACConfig.md index 11c8726f1..a87c63493 100644 --- a/Wiki posts/WDACConfig Module Main/New-SupplementalWDACConfig.md +++ b/Wiki posts/WDACConfig Module Main/New-SupplementalWDACConfig.md @@ -1,212 +1,7 @@ # New-SupplementalWDACConfig available parameters -## New-SupplementalWDACConfig -Normal - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-SupplementalWDACConfig/New-SupplementalWDACConfig%20-Normal.apng) - -## Syntax - -```powershell -New-SupplementalWDACConfig - [-Normal] - -ScanLocation - -SuppPolicyName - [-PolicyPath ] - [-Deploy] - [-SpecificFileNameLevel ] - [-NoUserPEs] - [-NoScript] - [-Level ] - [-Fallbacks ] - [] -``` - -## Description - -Creates a Supplemental policy for a base policy based on a folder path. - -## Parameters - -### -ScanLocation - -The directory or drive that you want to scan for files that will be allowed to run by the Supplemental policy. -Supports GUI folder picker, press TAB after the parameter to launch it. - -
- -| Type: |[DirectoryInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.directoryinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SuppPolicyName - -Add a descriptive name for the Supplemental policy. Accepts only alphanumeric and space characters. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -PolicyPath - -Browse for the xml file of the Base policy this Supplemental policy is going to expand. -Supports GUI file picker that only shows XML files, press TAB after the parameter to launch it. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Deploy - -Indicates that the module will automatically deploy the Supplemental policy after creation. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Levels - -Offers the same official [Levels](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-level) to scan the specified directory path. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `WHQLFilePublisher` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Fallbacks - -Offers the same official [Fallbacks](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-fallback) to scan the specified directory path. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | `FilePublisher`,`Hash` | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SpecificFileNameLevel - -[More info available on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-specificfilenamelevel) - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Accepted values: | `OriginalFileName`, `InternalName`, `FileDescription`, `ProductName`, `PackageFamilyName`, `FilePath` | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -NoUserPEs - -By default, the module includes user PEs in the scan. When you use this switch parameter, they won't be included. [More info available on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-userpes) - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -NoScript - -[More info available on Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/configci/new-cipolicy#-noscript) - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### The outputs of the parameter are - -* ***SupplementalPolicy``.xml*** -* ***{GUID}.cip*** - -
- -horizontal super thin rainbow RGB line - -
- ## New-SupplementalWDACConfig -PathWildCards -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-SupplementalWDACConfig/New-SupplementalWDACConfig%20-PathWildCards.apng) ## Syntax @@ -314,8 +109,6 @@ Indicates that the module will automatically deploy the Supplemental policy afte ## New-SupplementalWDACConfig -InstalledAppXPackages -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-SupplementalWDACConfig/New-SupplementalWDACConfig%20-InstalledAppXPackages.apng) - ## Syntax ```powershell @@ -441,8 +234,6 @@ Indicates that the cmdlet won't ask for confirmation and will proceed with creat ## New-SupplementalWDACConfig -Certificates -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-SupplementalWDACConfig/New-SupplementalWDACConfig%20-Certificates.gif) - ## Syntax ```powershell diff --git a/Wiki posts/WDACConfig Module Main/New-WDACConfig.md b/Wiki posts/WDACConfig Module Main/New-WDACConfig.md deleted file mode 100644 index af44e937d..000000000 --- a/Wiki posts/WDACConfig Module Main/New-WDACConfig.md +++ /dev/null @@ -1,262 +0,0 @@ -# New-WDACConfig available parameters - -## New-WDACConfig -PolicyType - -
-How to create, deploy and audit WDAC policies
- -
- -![New-WDACConfig -PolicyType](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-WDACConfig/New-WDACConfig%20-PolicyType.apng) - -## Syntax - -```powershell -New-WDACConfig - [-PolicyType ] - [-Deploy] - [-Audit] - [-TestMode] - [-RequireEVSigners] - [-EnableScriptEnforcement] - [-LogSize ] -``` - -## Description - -Use this parameter to create a new App Control **base policy** with different policy types and configurations. - -> [!NOTE]\ -> If the selected policy type is `DefaultWindows` and the detected PowerShell is not installed through Microsoft Store, the module will scan the PowerShell files and add them to the `DefaultWindows` base policy as allowed files so you will be able to continue using the module after deploying the policy. - -> [!Tip]\ -> The `SignedAndReputable` policy type uses ISG, [The Microsoft Intelligent Security Graph](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph). - -## Parameters - -### -PolicyType - -There are 3 policy types you can choose from and they are listed below: - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Accepted values: | `AllowMicrosoft`, `DefaultWindows`, `SignedAndReputable` | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Deploy - -Indicates that the policy is to be deployed to the local machine. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Audit - -Turns on Audit mode in the policy so that the policy will be auditing files after deployment instead of blocking them. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -TestMode - -Indicates that the created policy will have ***Enabled:Boot Audit on Failure*** and ***Enabled:Advanced Boot Options Menu*** [policy rule options](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options). - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -RequireEVSigners - -Indicates that the created policy will have [Require EV Signers](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-create-base-policy#advanced-policy-rules-description) policy rule option. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -EnableScriptEnforcement - -Enables [script enforcement](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/script-enforcement) in the created policy. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -LogSize - -> [!NOTE]\ -> This parameter is only available when the `-Audit` parameter is used. - -Specifies the log size for ***Microsoft-Windows-CodeIntegrity/Operational*** events. The values must be in the form of ``. e.g., 2MB, 10MB, 1GB, 1TB. The minimum accepted value is 1MB which is the default. - -
- -| Type: |[UInt64](https://learn.microsoft.com/en-us/dotnet/api/system.uint64)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -horizontal super thin rainbow RGB line - -
- -## New-WDACConfig -GetUserModeBlockRules - -![New-WDACConfig -GetUserModeBlockRules](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-WDACConfig/New-WDACConfig%20-GetUserModeBlockRules.apng) - -## Syntax - -```powershell -New-WDACConfig - [-GetUserModeBlockRules] - [-Deploy] -``` - -## Description - -Downloads the latest [Microsoft Recommended User-Mode Block Rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol). - -## Parameters - -### -Deploy - -Indicates that the policy is to be deployed to the local machine. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -horizontal super thin rainbow RGB line - -
- -## New-WDACConfig -GetDriverBlockRules - -![New-WDACConfig -GetDriverBlockRules](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-WDACConfig/New-WDACConfig%20-GetDriverBlockRules.apng) - -## Syntax - -```powershell -New-WDACConfig - [-GetDriverBlockRules] - [-Deploy] - [-AutoUpdate] -``` - -## Description - -Downloads the latest [Microsoft Recommended Drivers Block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules). - -## Parameters - -### -Deploy - -Indicates that the policy is to be deployed to the local machine. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -AutoUpdate - -Creates a scheduled task that runs every 7 days to automatically perform [the official method](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules#steps-to-download-and-apply-the-vulnerable-driver-blocklist-binary) for updating Microsoft recommended driver block rules. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
\ No newline at end of file diff --git a/Wiki posts/WDACConfig Module Main/Remove-CommonWDACConfig.md b/Wiki posts/WDACConfig Module Main/Remove-CommonWDACConfig.md deleted file mode 100644 index d11b414c7..000000000 --- a/Wiki posts/WDACConfig Module Main/Remove-CommonWDACConfig.md +++ /dev/null @@ -1,148 +0,0 @@ -# Remove-CommonWDACConfig available parameters - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Remove-CommonWDACConfig/Remove-CommonWDACConfig.apng) - -## Syntax - -```powershell -Remove-CommonWDACConfig - [-CertCN] - [-CertPath] - [-SignToolPath] - [-UnsignedPolicyPath] - [-SignedPolicyPath] - [-StrictKernelPolicyGUID] - [-StrictKernelNoFlightRootsPolicyGUID] -``` - -## Description - -Use this cmdlet to remove the values stored in the User Configurations JSON file. If you use it without any parameters it will delete the User configuration folder and everything in it, which is located in `C:\Users\UserName\.WDACConfig` - -## Parameters - -### -CertCN - -Removes the saved Certificate Common Name from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CertPath - -Removes the saved Certificate path from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SignToolPath - -Removes the saved SignTool.exe Path from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -UnsignedPolicyPath - -Removes the saved Unsigned Policy Path from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SignedPolicyPath - -Removes the saved Signed Policy Path from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -StrictKernelPolicyGUID - -Removes the saved Strict Kernel Policy GUID from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -StrictKernelNoFlightRootsPolicyGUID - -Removes the saved Strict Kernel NoFlight Roots Policy GUID from User Configurations - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Remove-WDACConfig.md b/Wiki posts/WDACConfig Module Main/Remove-WDACConfig.md deleted file mode 100644 index e2c9a0f1f..000000000 --- a/Wiki posts/WDACConfig Module Main/Remove-WDACConfig.md +++ /dev/null @@ -1,173 +0,0 @@ -# Remove-WDACConfig available parameters - -## Remove-WDACConfig -SignedBase - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Remove-WDACConfig/Remove-WDACConfig%20-SignedBase.apng) - -## Syntax - -```powershell -Remove-WDACConfig - [-SignedBase] - -PolicyPaths - [-CertCN ] - [-SignToolPath ] - [-Force] - [-Confirm] - [] -``` - -## Description - -Uses [the official procedure](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/disable-appcontrol-policies) to Re-Deploy the Signed base App Control policies with ***Enabled:Unsigned System Integrity Policy*** rule option. - -## Parameters - -### -PolicyPaths - -Path to xml file(s) of the currently deployed policy that you want to remove. Supports tab completion by showing only `.xml` files. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CertCN - -Common name of the certificate - Supports argument completion so you don't have to manually enter the Certificate's CN. Make sure the certificate is installed in the personal store of the user certificates, then press TAB to auto complete the name. You can however enter it manually if you want to. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SignToolPath - -Press TAB to open the file picker GUI and browse for SignTool.exe - -> [!IMPORTANT]\ -> Refer [to this section](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#the-logic-behind-the--signtoolpath-parameter-in-the-module) for more info - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| [Automatic:](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters) | True | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -Force - -Indicates that the cmdlet won't ask for confirmation and will proceed with redeploying the signed base policy in unsigned mode. - -
- -| Type: |[SwitchParameter](https://learn.microsoft.com/en-us/dotnet/api/system.management.automation.switchparameter)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -horizontal super thin rainbow RGB line - -
- -## Remove-WDACConfig -UnsignedOrSupplemental - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Remove-WDACConfig/Remove-WDACConfig%20-UnsignedOrSupplemental.apng) - -## Syntax - -```powershell -Remove-WDACConfig - [-UnsignedOrSupplemental] - [-PolicyNames ] - [-PolicyIDs ] - [-Force] - [-Confirm] - [] -``` - -## Description - -Removes Unsigned deployed App Control policies as well as [Signed deployed Supplemental App Control policies](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes#removing-supplemental-policies) - -> [!NOTE]\ -> When using `-PolicyNames` parameter, if multiple policies with the exact same name are deployed, when you press TAB, you will only see 1 of them, if you select it, all of the policies with that name will be removed. If that's not desired, consider using `-PolicyIDs` parameter instead. - -> [!NOTE]\ -> The auto-completion in these 2 parameters are smart. E.g., if there are 10 policies deployed on the system, you can press Tab to select 5 of them by IDs, but when you try to select the other 5 by their names, the name of the policies that you already selected by IDs don't show up anymore. This greatly reduces user error and simplifies the workflow for end user. - -## Parameters - -### -PolicyIDs - -The submitted values are verified against the currently deployed policies and if they match, the policies are removed. - -Just press TAB key and it will autofill the values for you based on the deployed policies. If you want to select multiple names, after each one, enter a comma `,` and then press TAB again to choose another name. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -PolicyNames - -The submitted values are verified against the currently deployed policies and if they match, the policies are removed. - -Just press TAB key and it will autofill the values for you based on the deployed policies. If you want to select multiple IDs, after each one, enter a comma `,` and then press TAB again to choose another ID. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)[]| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Set-CommonWDACConfig.md b/Wiki posts/WDACConfig Module Main/Set-CommonWDACConfig.md deleted file mode 100644 index 5dcf67d96..000000000 --- a/Wiki posts/WDACConfig Module Main/Set-CommonWDACConfig.md +++ /dev/null @@ -1,152 +0,0 @@ -# Set-CommonWDACConfig available parameters - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Set-CommonWDACConfig/Set-CommonWDACConfig.apng) - -## Syntax - -```powershell -Set-CommonWDACConfig - [[-CertCN] ] - [[-CertPath] ] - [[-SignToolPath] ] - [[-UnsignedPolicyPath] ] - [[-SignedPolicyPath] ] - [[-StrictKernelPolicyGUID] ] - [[-StrictKernelNoFlightRootsPolicyGUID] ] - [[-LastUpdateCheck] ] - [[-StrictKernelModePolicyTimeOfDeployment] ] - [[-AutoUpdate] ] - [] -``` - -## Description - -Use this cmdlet to store the values for common and frequently used parameters so that you won't have to specify them again every time. - -All of the applicable cmdlets of the module automatically check the User Configuration file for any available input, if you don't specify values for their parameters. Learn more about the User Configuration file [here](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig#about-automatic-parameters). - -
- -## An Example - -Instead of specifying all of the parameters for `Edit-SignedWDACConfig` cmdlet like this: - -```powershell -Edit-SignedWDACConfig -AllowNewApps -SuppPolicyName "App 1" -CertPath "Path To Certificate.cer" -PolicyPaths "Path To Policy.xml" -CertCN "Certificate Common Name" -``` - -You can just run this - -```powershell -Edit-SignedWDACConfig -AllowNewApps -SuppPolicyName "App 1" -``` - -If correct and valid values for the missing parameters exist in User Configuration file, the cmdlet will automatically detect and use them seamlessly. - -## Parameters - -### -CertCN - -Common Name of an installed certificate. Supports argument completion so you don't have to manually enter the Certificate's CN, just make sure the certificate is installed in the personal store of the user certificates, then press TAB to auto complete the name. You can however enter it manually if you want to. - -
- -| Type: |[String](https://learn.microsoft.com/en-us/dotnet/api/system.string)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -CertPath - -Path to the certificate `.cer` file. Press TAB to open the file picker GUI and browse for a `.cer` file. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SignToolPath - -Press TAB to open the file picker GUI and browse for SignTool.exe - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -UnSignedPolicyPath - -Path to the xml file of an Unsigned policy. Supports file picker GUI. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
- -### -SignedPolicyPath - -Path to the xml file of a Signed policy. Supports file picker GUI. - -
- -| Type: |[FileInfo](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileinfo)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -### -AutoUpdate - -Enables/Disable check for and downloading of new version of the WDACConfig module whenever it's available. - -
- -| Type: |[BooleanParameter](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_booleans)| -| :-------------: | :-------------: | -| Position: | Named | -| Default value: | None | -| Required: | False | -| Accept pipeline input: | False | -| Accept wildcard characters: | False | - -
- -
diff --git a/Wiki posts/WDACConfig Module Main/Test-CiPolicy.md b/Wiki posts/WDACConfig Module Main/Test-CiPolicy.md index b59f37bf5..b9b97a3b1 100644 --- a/Wiki posts/WDACConfig Module Main/Test-CiPolicy.md +++ b/Wiki posts/WDACConfig Module Main/Test-CiPolicy.md @@ -1,7 +1,5 @@ # Test-CiPolicy available parameters -![Test-CiPolicy demo](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/Test-CiPolicy/Test-CiPolicy%20-XmlFile.gif) - ## Syntax ```powershell diff --git a/Wiki posts/WDACConfig Module Main/WDACConfig.md b/Wiki posts/WDACConfig Module Main/WDACConfig.md index cef5e412d..ffed1ccd6 100644 --- a/Wiki posts/WDACConfig Module Main/WDACConfig.md +++ b/Wiki posts/WDACConfig Module Main/WDACConfig.md @@ -3,64 +3,18 @@ > [!IMPORTANT]\ > This module is being deprecated. Use the new AppControl Manager application -> https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager > -> YouTube demo: -> https://www.youtube.com/watch?v=SzMs13n7elE -
- -[**WDACConfig**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) is an advanced PowerShell module designed with the aim of automating [Application and File whitelisting in Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol) using App Control for Business. [You can always find its source code on GitHub](https://github.com/HotCakeX/Harden-Windows-Security/tree/main/WDACConfig) and Install it from [**PowerShell Gallery**](https://www.powershellgallery.com/packages/WDACConfig/). - -This page is also available [on my website.](https://spynetgirl.github.io/WDACConfig%20Module/WDACConfig/) - -
- -horizontal super thin rainbow RGB line - -
- -## Requirements - -* PowerShell Core latest version - - * Install from [GitHub](https://github.com/PowerShell/PowerShell/releases/latest) or [Microsoft Store](https://www.microsoft.com/store/productid/9MZ1SNWT0N5D) - -* Windows 11 latest version -* Administrator Privileges -* Internet Connection (for periodic update checks that happen every 30 minutes) - -
- -horizontal super thin rainbow RGB line - -
+## Preview of the App -## Features +
-* Uses the [official documented methods of the ConfigCI module](https://learn.microsoft.com/en-us/powershell/module/configci/). - -* Checks for new version periodically and updates itself automatically when necessary. - - - [Controllable](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Set-CommonWDACConfig) using `Set-CommonWDACConfig -AutoUpdate $True/$False`. - -* Actively trying to design it with [Microsoft Security Development Lifecycle (SDL)](https://www.microsoft.com/en-us/securityengineering/sdl/) guidelines in mind. - -* The module goes through Extended Validation before each update is released to make sure everything works perfectly. - -* The module can be used for managing local systems, remote systems and Azure VMs. - -* Use `-Verbose` common parameter with each cmdlet of the WDACConfig module to see extra details and what's happening under the hood. - -
- -horizontal super thin rainbow RGB line + AppControl Manager preview
-## Install The Module + AppControl Manager YouTube Video demo thumbnail -```powershell -Install-Module -Name 'WDACConfig' -Scope 'AllUsers' -Force -``` +

@@ -68,106 +22,14 @@ Install-Module -Name 'WDACConfig' -Scope 'AllUsers' -Force
-## Video Guides - -| Video Link | Description | -| :---: | :---: | -| MDE AH Demo | [Microsoft Defender For Endpoint Advanced Hunting With WDACConfig Module](https://youtu.be/oyz0jFzOOGA?si=tJbFbzRJNy79lUo7) | -| Sandboxing-like capabilities in the App Control Policies | [Sandboxing-like capabilities in the App Control Policies](https://www.youtube.com/watch?v=cp7TaTNPZE0) | -| Create, Deploy & Audit App Control Policies | [Create, Deploy & Audit App Control Policies](https://www.youtube.com/watch?v=JSwrfe9zYY4) | -| How To Set And Query Secure Settings in App Control Policies | [How To Set And Query Secure Settings in App Control Policies](https://www.youtube.com/watch?v=hNpzYlOMCys) | -| How To Create And Deploy Signed App Control Policies | [How To Create And Deploy Signed App Control Policies](https://www.youtube.com/watch?v=nZ5c9ceaEwA) | -| Simulating App Control Deployment in Windows | [Simulating App Control Deployment in Windows](https://www.youtube.com/watch?v=A0bKDaeYomg) | -| Create and Deploy Signed WDAC Windows Defender Policy YouTube Guide | [Create Code Signing Certificate Using Windows Server](https://youtu.be/RSYJ64BlS9Y?si=t6TlcYzsMwteG1M9) | - -
- -horizontal super thin rainbow RGB line - -
- -## WDACConfig Module's Table of Content +## WDACConfig Module's Table of Content [Deprecated] | Cmdlet Guide | Usage | PowerShell Console Help | | :---: | :---: | :---: | -| [New-WDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) | Mainly for creating and deploying App Control policies | `Get-Help New-WDACConfig` | | [New-SupplementalWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig) | To create and deploy Supplemental policies | `Get-Help New-SupplementalWDACConfig` | -| [Remove-WDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Remove-WDACConfig) | To remove deployed App Control policies | `Get-Help Remove-WDACConfig` | -| [Edit-WDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-WDACConfig) | To edit deployed unsigned App Control policies | `Get-Help Edit-WDACConfig` | | [Edit-SignedWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-SignedWDACConfig) | To edit deployed signed App Control policies | `Get-Help Edit-SignedWDACConfig` | -| [Deploy-SignedWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig) | To sign and deploy App Control policies | `Get-Help Deploy-SignedWDACConfig` | -| [Confirm-WDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Confirm-WDACConfig) | To confirm deployment and check the status of App Control policies | `Get-Help Confirm-WDACConfig` | | [New-DenyWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-DenyWDACConfig) | To create a deny mode App Control policy | `Get-Help New-DenyWDACConfig` | -| [Set-CommonWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Set-CommonWDACConfig) | To add or edit user configurations for common WDACConfig parameters | `Get-Help Set-CommonWDACConfig` | | [New-KernelModeWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New%E2%80%90KernelModeWDACConfig) | To create a Strict Kernel mode App Control policy for [total BYOVD protection](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) | `Get-Help New-KernelModeWDACConfig` | -| [Get-CommonWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Get-CommonWDACConfig) | To display or fetch user configurations for common WDACConfig parameters | `Get-Help Get-CommonWDACConfig` | -| [Invoke-WDACSimulation](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Invoke-WDACSimulation) | To simulate an App Control policy deployment quickly | `Get-Help Invoke-WDACSimulation` | -| [Remove-CommonWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Remove-CommonWDACConfig) | To remove user configurations for common WDACConfig parameters | `Get-Help Remove-CommonWDACConfig` | -| [Assert-WDACConfigIntegrity](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Assert-WDACConfigIntegrity) | To ascertain that the files in your local WDACConfig folder are identical to the ones in the cloud | `Get-Help Assert-WDACConfigIntegrity` | -| [Build-WDACCertificate](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Build-WDACCertificate) | To create proper code signing certificates for App Control policy signing | `Get-Help Build-WDACCertificate` | | [Test-CiPolicy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Test-CiPolicy) | Tests a Code Integrity (App Control) Policy XML file against the Schema and shows the signers in a signed `.CIP` files | `Get-Help Test-CiPolicy` | -| [Get-CiFileHashes](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Get-CiFileHashes) | Calculates the Authenticode hash and first page hash of the PEs with SHA1 and SHA256 algorithms | `Get-Help Get-CiFileHashes` | -| [ConvertTo-WDACPolicy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/ConvertTo-WDACPolicy) | Multi-Purpose & Powerful functionalities such as converting local and MDE logs to App Control Policies | `Get-Help ConvertTo-WDACPolicy` | -| [Get-CIPolicySetting](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Get-CIPolicySetting) | Queries the Secure Settings among the deployed policies on the system | `Get-Help Get-CIPolicySetting` | - -
- -horizontal super thin rainbow RGB line - -
- -## User Configurations Directory - -The module stores user configurations and all of the outputs only in the following directory: - -``` -C:\Program Files\WDACConfig -``` - -It's an Admin-protected path that provides security against non-elevated users and processes. - -
- -### The Temporary Files Are Stored in the Following Directory - -``` -C:\Program Files\WDACConfig\StagingArea -``` - -Each cmdlet of the module creates a subdirectory in the StagingArea to store its temporary files. The subdirectory is named after the cmdlet's name. At the end of the cmdlet's execution, the temporary subdirectory is deleted, unless the `-Debug` parameter is used. - -
- -horizontal super thin rainbow RGB line - -
- -## About Automatic Parameters - -A parameter with an **Automatic** value of True in the description means that the module will use its default value set by the [Set-CommonWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Set-CommonWDACConfig) cmdlet. This simplifies the process and avoids redundancy. However, if an Automatic parameter has no value in User Configurations and you do not specify one in the command line, you will encounter an error requesting a value. Specifying a value for an Automatic parameter in the command line supersedes its default value in User Configurations, so the module will disregard the value of that parameter in the User Configurations file. - -
- -### The Logic Behind The -SignToolPath Parameter in the Module - -1. If [Windows SDK](https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/) Signing Tools for Desktop Apps components is installed in the default location `C:\Program Files (x86)\Windows Kits`, then specifying `-SignToolPath` parameter isn't necessary as the SignTool.exe will be detected automatically. - -2. If Windows SDK Signing Tools for Desktop Apps components is not installed in the default location or you want to manually browse for the signtool.exe, then make sure you either specify its path using `Set-CommonWDACConfig -SignToolPath` or use the `-SignToolPath` parameter. - -3. If SignTool.exe path is available in user configurations then it will be automatically used. - -4. Specifying `-SignToolPath` parameter explicitly on the command line takes priority over auto detection and value in the user configurations. - -5. If SignTool.exe cannot be auto-detected and the user didn't specify it on the command line, you will receive a prompt to authorize the automatic download of the most recent SignTool.exe version from the official Microsoft servers. Upon confirmation, it will be saved in your user configurations and utilized by the cmdlet. - -
- -horizontal super thin rainbow RGB line - -
- -## Feedback and Feature Request - -If there are any feedback or feature requests regarding this module, please [open a new discussion/issue on GitHub.](https://github.com/HotCakeX/Harden-Windows-Security)
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/Fast and Automatic Microsoft Recommended Driver Block Rules updates.md b/Wiki posts/Windows Defender Application Control (WDAC)/Fast and Automatic Microsoft Recommended Driver Block Rules updates.md deleted file mode 100644 index 6df251ded..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/Fast and Automatic Microsoft Recommended Driver Block Rules updates.md +++ /dev/null @@ -1,43 +0,0 @@ -# Fast and Automatic Microsoft Recommended Driver Block Rules updates - -
- -[The blocklist is updated with each new major release of Windows, typically 1-2 times per year](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules), but you can deploy the recommended driver block rules policy more frequently. - -[This is the GitHub source](https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md) for the XML content shown on the Microsoft document website. You can see when the last time it was changed was, read the change history and commit messages. The script below **automates** the required [steps explained on the document](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules#steps-to-download-and-apply-the-vulnerable-driver-blocklist-binary) to download and deploy the recommended driver block rules. Make sure you are using the latest version of Windows. - -## Use the [WDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) Module - -![image](https://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/Wiki%20APNGs/New-WDACConfig/New-WDACConfig%20-GetDriverBlockRules.apng) - -You can use the [WDACConfig Module](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig#new-wdacconfig--getdriverblockrules) to create a scheduled task in Windows that will **automatically** run the script below every 7 days. - -```powershell -Install-Module -Name WDACConfig -Force -New-WDACConfig -GetDriverBlockRules -AutoUpdate -``` - -
-The script - -```powershell -try { - Invoke-WebRequest -Uri 'https://aka.ms/VulnerableDriverBlockList' -OutFile VulnerableDriverBlockList.zip -ErrorAction Stop -} -catch { - exit 1 -} -Expand-Archive -Path .\VulnerableDriverBlockList.zip -DestinationPath 'VulnerableDriverBlockList' -Force -Rename-Item -Path .\VulnerableDriverBlockList\SiPolicy_Enforced.p7b -NewName 'SiPolicy.p7b' -Force -Copy-Item -Path .\VulnerableDriverBlockList\SiPolicy.p7b -Destination "$env:SystemDrive\Windows\System32\CodeIntegrity" -citool --refresh -json -Remove-Item -Path .\VulnerableDriverBlockList -Recurse -Force -Remove-Item -Path .\VulnerableDriverBlockList.zip -Force -exit 0 -``` - -
- -
- -Microsoft recommended driver block rules that are enforced as a result of using either memory integrity (also known as hypervisor-protected code integrity or HVCI), Smart App Control, or S mode, are saved in a file called `driversipolicy.p7b` in the `%windir%\system32\CodeIntegrity` directory. The file you will be downloading from Microsoft document is called `SiPolicy.p7b` and it won't overwrite the `driversipolicy.p7b` but it will take precedence over the `driversipolicy.p7b` when deployed, because it has newer version and you can verify it after using CiTool by observing the Code Integrity event logs as described in the document. diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/Introduction.md b/Wiki posts/Windows Defender Application Control (WDAC)/Introduction.md deleted file mode 100644 index 94d7b5912..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/Introduction.md +++ /dev/null @@ -1,85 +0,0 @@ -# What is Application Control for Business? - -
-App Control for Business introduction -
- -
- -Application control is crucial for protecting computer systems in today's threat landscape and offers a distinct advantage over traditional antivirus solutions. Specifically, application control uses tailored access, shifting from a model where all applications are assumed trustworthy to one where applications must earn trust before they can run. - -Devices where Application Control policies are deployed on can either be centrally managed via MDM, Intune etc. or they can be home devices, devices that are private and don't belong to any organization, the computer of someone that you want to keep very much safe and secure [so that even the device's owner can't willingly or forcefully compromise themselves,](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control) the possibilities are endless. - -
- -> [!IMPORTANT]\ -> Use [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) for all of your Application Control and Code Integrity management needs. It is scalable, easy to use, enterprise-ready, Azure VM ready and more importantly, it is free, open-source and always will be that way. - -
- -App Control puts the power of security directly in your hands, giving you complete control over your system and the systems you manage. Unlike other solutions that create dependency on other people, App Control eliminates the need to constantly chase and block new malware variants. Once you configure your system and define the apps and files that are permitted to run, everything else is automatically blocked. - -**It's time to shift from a reactive approach to a proactive one.** - -
- -## Application Control Usage Levels - -There are many ways you can utilize Application Control features and here they are sorted by the level of restriction and protection they provide; From top (having the least restriction and protection) to bottom (having the most restriction and protection). - -1. Use Microsoft recommended driver block rules. - - **No user action required**; The vulnerable driver blocklist is enabled by default for all devices using HVCI or Memory Integrity. - - [The built-in driver blocklist is updated with each new major release of Windows, typically 1-2 times per year.](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) - -2. Update Microsoft recommended driver block rules outside of the twice a year schedule. - - The drivers block list itself [is updated more frequently](https://github.com/MicrosoftDocs/windows-itpro-docs/commits/public/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md) than twice a year schedule, [use the AppControl Manager to setup a scheduled task that keeps the list up-to-date.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Fast-and-Automatic-Microsoft-Recommended-Driver-Block-Rules-updates) -3. Use Microsoft recommended block rules + Recommended driver block rules - - Use the [AppControl Manager](https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager) to easily deploy the User-Mode Microsoft recommended block rules on your system. -4. Create WDAC policy for **Lightly managed devices** - - [Microsoft's guide: Create a WDAC policy for lightly managed devices](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-lightly-managed-devices) - - [My guide: WDAC for Lightly Managed Devices](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Lightly-Managed-Devices) -5. Use [Smart App Control](https://support.microsoft.com/en-us/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) - - It's just a toggle in Windows Security under App & Browser control. It uses a special kind of WDAC policy that provides more protection than a lightly managed workstation but less protection than a fully managed workstation. - - It uses both of Microsoft's recommended block rules. -6. Use Smart App Control + [Strict Kernel-Mode WDAC Policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New%E2%80%90KernelModeWDACConfig) -7. Create WDAC policy for **Fully managed devices** - - The following scenarios provide the highest protection against any threats from any sources when cryptographically signed and deployed and properly configured. - - [WDAC for Fully managed device - Variant 1](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Fully-Managed-Devices) - - [WDAC for Fully managed device - Variant 2](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-for-Fully-Managed-Devices--Variant-2) - - [WDAC for Fully managed device - Variant 3](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-Fully-managed-device---Variant-3) - - [WDAC for Fully managed device - Variant 4](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-Fully-managed-device---Variant-4) - - [Microsoft's guide: Create a WDAC policy for fully managed devices](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-fully-managed-devices) - - [Microsoft's guide: Create a WDAC policy for fixed-workload devices (reference computer)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-using-reference-computer) - - [Microsoft's guide: Use audit events to create WDAC policy rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies) - -
- -## Plan for App Control for Business lifecycle policy management - -Microsoft provides the [following official document](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/plan-appcontrol-management) to understand the decisions you need to make to establish the processes for managing and maintaining Application Control policies. The rest of them are mentioned below at the **Resources** section. - -
- -## Documents - -* [Application Control for Windows](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol) -* [Understand App Control for Business policy design decisions](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/understand-appcontrol-policy-design-decisions) -* [Deploying App Control for Business policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide) -* [Use multiple App Control for Business Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/deploy-multiple-appcontrol-policies) -* [Use audit events to create WDAC policy rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/audit-appcontrol-policies) -* [Merge App Control for Business policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/merge-appcontrol-policies) -* [Understand App Control for Business policy rules and file rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#app-control-for-business-policy-rules) -* [Testing and Debugging AppId Tagging Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/AppIdTagging/debugging-operational-guide-appid-tagging-policies) -* [Editing existing base and supplemental WDAC policies with the Wizard](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-editing-policy) -* [Creating a new Supplemental Policy with the Wizard](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-wizard-create-supplemental-policy) -* [App Control for Business example base policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/example-appcontrol-base-policies) -* [Configure the Application Identity service](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service) -* [Microsoft recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) -* [Microsoft recommended block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol) -* [Create a WDAC policy using a reference computer (for fixed-workload devices)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-using-reference-computer) -* [Create a WDAC policy for fully managed devices](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-fully-managed-devices) -* [Create a WDAC policy for lightly managed devices](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-policy-for-lightly-managed-devices) -* [Guidance on Creating WDAC Deny Policies](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/create-appcontrol-deny-policy) -* [Hypervisor-protected Code Integrity enablement](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-hvci-enablement) - -
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 1.md b/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 1.md deleted file mode 100644 index dd5b5326e..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 1.md +++ /dev/null @@ -1,100 +0,0 @@ -# WDAC policy for Fully Managed device - Variant 1 - -
- -| Base policy type|Method used|Signed | Protection score 1-5 | -| :-------------: | :-------------: | :-------------: | :-------------: | -| Allow Microsoft / Default Windows | [WDACConfig module](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) | No | 4 | - -
- -> [!NOTE]\ -> This variant helps you create and deploy an App Control policy for fully managed device ***using only Event Viewer audit logs.*** -> -> This scenario includes using explicit Allow rules for files and certificates/signers, anything not allowed by the policies we are going to make are automatically denied/blocked. - -
- -horizontal super thin rainbow RGB line - -
- -## Prepare a Virtual Machine - -Install Hyper-V role from optional Windows features if you haven't already. - -```powershell -Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All -norestart -``` - -
- -Download the latest Windows `.ISO` file [from Microsoft website](https://www.microsoft.com/software-download/), create a new VM with it, install Windows and log in. Fully update Windows and then restart to apply the updates. You can create a Hyper-V checkpoint at this point so that you can return back to this clean state later on if you need to. - -
- -horizontal super thin rainbow RGB line - -
- -## Prepare a Base policy - -There are 2 types of base policies you can choose from. - -1. Allow Microsoft: Allows only files and apps that are signed by Microsoft's trusted root certificates. - -2. Default Windows: Allows only files and apps that come pre-installed by Windows. - -### Deploy the Allow Microsoft Audit Mode Base Policy - -```powershell -New-WDACConfig -PolicyType AllowMicrosoft -Audit -LogSize 20MB -``` - -### Deploy the Default Windows Audit Mode Base Policy - -```powershell -New-WDACConfig -PolicyType DefaultWindows -Audit -LogSize 20MB -``` - -* [Parameter Info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) - -
- -Depending on whichever of the option you choose, it deploys the base policy in audit mode. No reboot required. - -
- -horizontal super thin rainbow RGB line - -
- -## Generate Audit Event Logs on the System - -Install all of the programs that you want to allow in the App Control policy, on the VM. These are the programs that you want to allow to run and be installed on the target system once you've deployed the App Control policy. - -* Installing or running 3rd party non-Microsoft programs, while ***Allow Microsoft*** policy in Audit mode is deployed on the VM, generates event logs for each of the programs and their files. - -* Installing or running any program that doesn't come pre-installed by default with Windows, while **Default Windows** policy in Audit mode is deployed on the VM, generates event logs for each of the programs and their files. - -These event logs are exactly what we need to identify and create Allow rules for the detected files. - -Only files that are executed during audit mode phase generate event logs, so by simply installing a program using its installer, we can't trigger event log generation for each of the components and executables that each program has. So, after installing the programs, run them, use them a bit as you normally would so that all of the programs' components are executed and event logs generated for them. - -
- -horizontal super thin rainbow RGB line - -
- -## Generate Supplemental Policy From the Audit Event Logs - -Run the following command which will scan the local machine's Code Integrity and AppLocker logs and display them to you in a nice GUI (Graphical User Interface) window so that you can see detailed information of each file and choose which ones you want to include in the supplemental policy. - -```powershell -ConvertTo-WDACPolicy -BasePolicyFile -``` - -The cmdlet offers a lot more features, [**you can read about them here**](https://github.com/HotCakeX/Harden-Windows-Security/wiki/ConvertTo-WDACPolicy). - -
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 2.md b/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 2.md deleted file mode 100644 index 08905ead0..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 2.md +++ /dev/null @@ -1,134 +0,0 @@ -# WDAC policy for Fully managed device - Variant 2 - -
- -| Base policy type|Method used|Signed | Protection score 1-5 | -| :-------------: | :-------------: | :-------------: | :-------------: | -| Default Windows | [WDACConfig module](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) | No | 4 | - -
- -
- -```mermaid -flowchart TD - A(Deploy Default Windows base policy) -->B(Identify Important apps that need Supplemental policy) - B --> C[Create Supplemental policy based on App's directory] - C --> D[Want to allow an entire directory?] - D --> E[New-SupplementalWDACConfig -FilePathWildCards] - C --> F[Want to Scan the app's install directory?] - F --> G[New-SupplementalWDACConfig -Normal] - B --> H[Is it a game Installed using Xbox app?] - H --> I[Or Is it an app that installs drivers outside app's directory?] - I --> J[Edit-WDACConfig -AllowNewApps] -``` - -> [!NOTE]\ -> *Every time I use the word "App", I'm referring to regular Win32 programs as well as Microsoft Store installed apps; Basically, any software that you can run.* -> -> This scenario provides a very high protection level. Using the WDACConfig module, it's very easy to deploy, manage and maintain a system with this configuration. - -
- -horizontal super thin rainbow RGB line - -
- -## Deploy the Default Windows Base Policy on the System - -Start by deploying the Default Windows base policy on the system, which allows only files and apps that come pre-installed in Windows to run and anything else is blocked. - -Since this is an unsigned policy, no reboot is required but it's better to perform a reboot if you want the currently running non-Windows apps to stop running. - -
- -```powershell -New-WDACConfig -PolicyType DefaultWindows -Deploy -``` - -* [Cmdlet info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) - -After deploying the base policy, you can create Supplemental policies to allow other apps that don't come by default with Windows to run. To do that, you have multiple options. - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for Apps Already Installed - -If you deployed the Default Windows base policy on a system that already had apps installed, you can create Supplemental policy for them using the following syntaxes: - -### Based on Signer Rules, Hashes, File Names Etc. - -```powershell -New-SupplementalWDACConfig -Normal -ScanLocation "C:\Program Files\Program" -SuppPolicyName "App's Name" -PolicyPath "C:\DefaultWindowsPlusBlockRules.xml" -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--normal) - -
- -### Based on File Path With One or More Wildcard Characters - -```powershell -New-SupplementalWDACConfig -FilePathWildCards -WildCardPath "C:\Program Files\Program\*" -SuppPolicyName "App's Name" -PolicyPath -"C:\DefaultWindowsPlusBlockRules.xml" -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--filepathwildcards) - -
- -### Based on an Installed Windows App’s Name - -```powershell -New-SupplementalWDACConfig -InstalledAppXPackages -PackageName "*App's name*" -SuppPolicyName "App's name" -PolicyPath "C:\DefaultWindowsPlusBlockRules.xml" -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--installedappxpackages) - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for New App Installations or Apps Already Installed - -If the app you are trying to allow isn't installed and when you try to install it you see a blocked/error message, you can use the following syntaxes to allow them to run and then automatically create Supplemental policy for them. - -These methods also work for apps that were installed prior to deploying the Default Windows base policy and now you want to allow them to run by creating Supplemental policy for them. - -You can create a Supplemental policy for more than 1 app at a time by browsing for multiple apps' install directories using the commands below. - -### Based on App’s Install Directory and Other Signals - -```powershell -Edit-WDACConfig -AllowNewApps -SuppPolicyName "App's Name" -PolicyPath "C:\DefaultWindowsPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-WDACConfig#edit-wdacconfig--allownewapps) - -
- -horizontal super thin rainbow RGB line - -
- -## What to Do When There Is an Update for an Allowed App? - -If you've created a Supplemental policy for an app that is already installed and now there is a newer version of that app available, you have multiple options: - -1. If the Supplemental policy that you created to allow that app is based on FilePath with wildcards, then the app can be updated and no change in policy is required. - -2. If the Supplemental policy is based on [PFN (Package Family Name)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/manage-packaged-apps-with-appcontrol) of the app, available only for apps that use [MSIX](https://learn.microsoft.com/en-us/windows/msix/overview) installers, like some of the modern apps installed through Microsoft Store, then you don't need to take any action and the app will be updated without any issues. - -3. If the Supplemental policy is only based on the app's digital signature, which is common for well-made apps, then you don't need to take any further action. As long as the new version of the app has the same digital signature / developer identity, then it will be allowed to run. - -4. If the Supplemental policy is based on individual File Paths (in contrast to wildcard FilePath rules), or based on [FileName rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-3--specificfilenamelevel-options), then most likely there is no need for any further action to be taken as long as the new app's version uses the same file names or the same file paths for its components. - -5. If the Supplemental policy is based on Hash of the app's files, either partially (mixed with signer rules) or entirely (for apps without any digital identity/signature) then all you have to do is to remove the deployed Supplemental policy and create a new Supplemental policy for the app using live audit mode in the module as explained above. Don't need to reboot immediately, but to finish the removal process of a Supplemental policy, whether it's signed or unsigned, a reboot will be eventually needed. - -
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 3.md b/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 3.md deleted file mode 100644 index 4db4050fd..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 3.md +++ /dev/null @@ -1,148 +0,0 @@ -# WDAC policy for Fully managed device - Variant 3 - -
- -| Base policy type|Method used|Signed | Protection score 1-5 | -| :-------------: | :-------------: | :-------------: | :-------------: | -| Allow Microsoft | [WDACConfig module](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) | Yes | 4.5 | - -
- -
- -```mermaid -flowchart TD - A(Deploy Allow Microsoft Signed base policy) -->B(Identify Important apps that need Supplemental policy) - B --> C[Create Supplemental policy based on App's directory] - C --> D[Want to allow an entire directory?] - D --> E[New-SupplementalWDACConfig -FilePathWildCards] - E --> AA[Deploy-SignedWDACConfig] - C --> F[Want to Scan the app's install directory?] - F --> G[New-SupplementalWDACConfig -Normal] - G --> AB[Deploy-SignedWDACConfig] - B --> H[Is it a game Installed using Xbox app?] - H --> I[Or Is it an app that installs drivers outside app's directory?] - I --> J[Edit-SignedWDACConfig -AllowNewApps] -``` - -> [!NOTE]\ -> *Every time I use the word "App", I'm referring to regular Win32 programs as well as Microsoft Store installed apps; Basically, any software that you can run.* -> -> This scenario provides a very high protection level. Using the WDACConfig module, it's very easy to deploy, manage and maintain a system with this configuration. - -
- -horizontal super thin rainbow RGB line - -
- -## Deploy the Allow Microsoft Base Policy on the System - -Start by creating the Allow Microsoft base policy xml file, which allows only files and apps that are signed by Microsoft's trusted root certificate. - -```powershell -New-WDACConfig -PolicyType AllowMicrosoft -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) - -
- -Now what we have the policy xml file for the Allow Microsoft base policy, we need to sign and deploy it. - -```powershell -Deploy-SignedWDACConfig -CertPath "C:\Certificate.cer" -PolicyPaths "C:\AllowMicrosoftPlusBlockRules.xml" -CertCN "App Control Certificate" -Deploy -``` - -* [Cmdlet info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig) - -
- -Since this is a signed base policy, you need to perform a reboot after deployment so that [the anti-tamper protection of a signed base policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control#if-someone-forcefully-deletes-the-deployed-wdac-policy-file) will start. - -After deploying the base policy, you can create Supplemental policies to allow other apps that aren't signed by Microsoft's trusted root certificate to run. To do that, you have multiple options. - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for Apps Already Installed - -If you deployed the Allow Microsoft base policy on a system that already had apps installed, you can create Supplemental policy for them using the following syntaxes. **After creating each Supplemental policy, you need to sign and deploy it [using the same Cmdlet we used above.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig)** - -### Based on Signer Rules, Hashes, File Names Etc. - -```powershell -New-SupplementalWDACConfig -Normal -ScanLocation "C:\Program Files\Program" -SuppPolicyName "App's Name" -PolicyPath "C:\AllowMicrosoftPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--normal) - -
- -### Based on File Path With One or More Wildcard Characters - -```powershell -New-SupplementalWDACConfig -FilePathWildCards -WildCardPath "C:\Program Files\Program\*" -SuppPolicyName "App's Name" -PolicyPath -"C:\AllowMicrosoftPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--filepathwildcards) - -
- -### Based on an Installed Windows App’s Name - -```powershell -New-SupplementalWDACConfig -InstalledAppXPackages -PackageName "*App's name*" -SuppPolicyName "App's name" -PolicyPath "C:\AllowMicrosoftPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--installedappxpackages) - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for New App Installations or Apps Already Installed - -If the app you are trying to allow isn't installed and when you try to install it you see a blocked/error message, you can use the following syntaxes to allow them to run and then automatically create Supplemental policy for them. - -These methods also work for apps that were installed prior to deploying the Allow Microsoft base policy and now you want to allow them to run by creating Supplemental policy for them. - -You can create a Supplemental policy for more than 1 app at a time by browsing for multiple apps' install directories using the commands below. - -
- -### Based on App’s Install Directory and Other Signals - -```powershell -Edit-SignedWDACConfig -AllowNewApps -CertPath "C:\Certificate.cer" -SuppPolicyName "App's Name" -PolicyPath "C:\AllowMicrosoftPlusBlockRules.xml" -CertCN "App Control Certificate" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-SignedWDACConfig#edit-signedwdacconfig--allownewapps) - -
- -horizontal super thin rainbow RGB line - -
- -## What to Do When There Is an Update for an Allowed App? - -If you've created a Supplemental policy for an app that is already installed and now there is a newer version of that app available, you have multiple options: - -1. If the Supplemental policy that you created to allow that app is based on FilePath with wildcards, then the app can be updated and no change in policy is required. - -2. If the Supplemental policy is based on [PFN (Package Family Name)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/manage-packaged-apps-with-appcontrol) of the app, available only for apps that use [MSIX](https://learn.microsoft.com/en-us/windows/msix/overview) installers, like some of the modern apps installed through Microsoft Store, then you don't need to take any action and the app will be updated without any issues. - -3. If the Supplemental policy is only based on the app's digital signature, which is common for well-made apps, then you don't need to take any further action. As long as the new version of the app has the same digital signature / developer identity, then it will be allowed to run. - -4. If the Supplemental policy is based on individual File Paths (in contrast to wildcard FilePath rules), or based on [FileName rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-3--specificfilenamelevel-options), then most likely there is no need for any further action to be taken as long as the new app's version uses the same file names or the same file paths for its components. - -5. If the Supplemental policy is based on Hash of the app's files, either partially (mixed with signer rules) or entirely (for apps without any digital identity/signature) then all you have to do is to remove the deployed Supplemental policy and create a new Supplemental policy for the app using live audit mode in the module as explained above. Don't need to reboot immediately, but to finish the removal process of a Supplemental policy, whether it's signed or unsigned, a reboot will be eventually needed. - -
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 4.md b/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 4.md deleted file mode 100644 index 89b1ac014..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Fully managed device - Variant 4.md +++ /dev/null @@ -1,146 +0,0 @@ -# WDAC policy for Fully managed device - Variant 4 - -
- -| Base policy type|Method used|Signed | Protection score 1-5 | -| :-------------: | :-------------: | :-------------: | :-------------: | -| Default Windows | [WDACConfig module](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) | Yes | 5 | - -
- -
- -```mermaid -flowchart TD - A(Deploy Default Windows Signed base policy) -->B(Identify Important apps that need Supplemental policy) - B --> C[Create Supplemental policy based on App's directory] - C --> D[Want to allow an entire directory?] - D --> E[New-SupplementalWDACConfig -FilePathWildCards] - E --> AA[Deploy-SignedWDACConfig] - C --> F[Want to Scan the app's install directory?] - F --> G[New-SupplementalWDACConfig -Normal] - G --> AB[Deploy-SignedWDACConfig] - B --> H[Is it a game Installed using Xbox app?] - H --> I[Or Is it an app that installs drivers outside app's directory?] - I --> J[Edit-SignedWDACConfig -AllowNewApps] -``` - -> [!NOTE]\ -> *Every time I use the word "App", I'm referring to regular Win32 programs as well as Microsoft Store installed apps; Basically, any software that you can run.* -> -> This scenario provides the ultimate protection level. Using the WDACConfig module, it's very easy to deploy, manage and maintain a system with this configuration. - -
- -horizontal super thin rainbow RGB line - -
- -## Deploy the Default Windows Base Policy on the System - -Start by creating the Default Windows base policy xml file, which allows only files and apps that come pre-installed in Windows to run and anything else is blocked. - -```powershell -New-WDACConfig -PolicyType DefaultWindows -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) - -
- -Now what we have the policy xml file for the Default Windows base policy, we need to sign and deploy it. - -```powershell -Deploy-SignedWDACConfig -CertPath "C:\Certificate.cer" -PolicyPaths "C:\DefaultWindowsPlusBlockRules.xml" -CertCN "App Control Certificate" -Deploy -``` - -* [Cmdlet info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig) - -
- -Since this is a signed base policy, you need to perform a reboot after deployment so that [the anti-tamper protection of a signed base policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-Windows-Defender-Application-Control#if-someone-forcefully-deletes-the-deployed-wdac-policy-file) will start. - -After deploying the base policy, you can create Supplemental policies to allow other apps that don't come by default with Windows to run. To do that, you have multiple options. - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for Apps Already Installed - -If you deployed the Default Windows base policy on a system that already had apps installed, you can create Supplemental policy for them using the following syntaxes. **After creating each Supplemental policy, you need to sign and deploy it [using the same Cmdlet we used above.](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig)** - -### Based on Signer Rules, Hashes, File Names Etc. - -```powershell -New-SupplementalWDACConfig -Normal -ScanLocation "C:\Program Files\Program" -SuppPolicyName "App's Name" -PolicyPath "C:\DefaultWindowsPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--normal) - -
- -### Based on File Path With One or More Wildcard Characters - -```powershell -New-SupplementalWDACConfig -FilePathWildCards -WildCardPath "C:\Program Files\Program\*" -SuppPolicyName "App's Name" -PolicyPath -"C:\DefaultWindowsPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--filepathwildcards) - -
- -### Based on an Installed Windows App’s Name - -```powershell -New-SupplementalWDACConfig -InstalledAppXPackages -PackageName "*App's name*" -SuppPolicyName "App's name" -PolicyPath "C:\DefaultWindowsPlusBlockRules.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--installedappxpackages) - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for New App Installations or Apps Already Installed - -If the app you are trying to allow isn't installed and when you try to install it you see a blocked/error message, you can use the following syntaxes to allow them to run and then automatically create Supplemental policy for them. - -These methods also work for apps that were installed prior to deploying the Default Windows base policy and now you want to allow them to run by creating Supplemental policy for them. - -You can create a Supplemental policy for more than 1 app at a time by browsing for multiple apps' install directories using the commands below. - -### Based on App's install directory and Other Signals - -```powershell -Edit-SignedWDACConfig -AllowNewApps -CertPath "C:\Certificate.cer" -SuppPolicyName "App's Name" -PolicyPath "C:\DefaultWindowsPlusBlockRules.xml" -CertCN "App Control Certificate" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-SignedWDACConfig#edit-signedwdacconfig--allownewapps) - -
- -horizontal super thin rainbow RGB line - -
- -## What to Do When There Is an Update for an Allowed App? - -If you've created a Supplemental policy for an app that is already installed and now there is a newer version of that app available, you have multiple options: - -1. If the Supplemental policy that you created to allow that app is based on FilePath with wildcards, then the app can be updated and no change in policy is required. - -2. If the Supplemental policy is based on [PFN (Package Family Name)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/manage-packaged-apps-with-appcontrol) of the app, available only for apps that use [MSIX](https://learn.microsoft.com/en-us/windows/msix/overview) installers, like some of the modern apps installed through Microsoft Store, then you don't need to take any action and the app will be updated without any issues. - -3. If the Supplemental policy is only based on the app's digital signature, which is common for well-made apps, then you don't need to take any further action. As long as the new version of the app has the same digital signature / developer identity, then it will be allowed to run. - -4. If the Supplemental policy is based on individual File Paths (in contrast to wildcard FilePath rules), or based on [FileName rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-3--specificfilenamelevel-options), then most likely there is no need for any further action to be taken as long as the new app's version uses the same file names or the same file paths for its components. - -5. If the Supplemental policy is based on Hash of the app's files, either partially (mixed with signer rules) or entirely (for apps without any digital identity/signature) then all you have to do is to remove the deployed Supplemental policy and create a new Supplemental policy for the app using live audit mode in the module as explained above. Don't need to reboot immediately, but to finish the removal process of a Supplemental policy, whether it's signed or unsigned, a reboot will be eventually needed. - -
diff --git a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Lightly Managed Devices.md b/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Lightly Managed Devices.md deleted file mode 100644 index 2a5067df5..000000000 --- a/Wiki posts/Windows Defender Application Control (WDAC)/WDAC for Lightly Managed Devices.md +++ /dev/null @@ -1,187 +0,0 @@ -# WDAC policy for Lightly managed device - -
- -| Base policy type|Method used|Signed | Protection score 1-5 | -| :-------------: | :-------------: | :-------------: | :-------------: | -| [SignedAndReputable (ISG)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph#configuring-isg-authorization-for-your-wdac-policy) | [WDACConfig module](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDACConfig) | No / Yes | 3.5 / 4 | - -
- -
- -```mermaid -flowchart TD - A(Deploy App Control base policy with ISG) -->B(Start using your apps) - B --> C(Did your app run without problem?) - C -->|Yes| D[Awesome] - C -->|No| E[Create a Supplemental policy for it] -``` - -> [!NOTE]\ -> *Every time I use the word "App", I'm referring to regular Win32 programs as well as Microsoft Store installed apps; Basically any software that you can run.* -> -> This scenario provides a high protection level, ***higher if you cryptographically Sign it***. Using the WDACConfig module, it's very easy to deploy, manage and maintain a system with this configuration. - -
- -horizontal super thin rainbow RGB line - -
- -## Deploy the SignedAndReputable Base Policy on the System - -Start by deploying the SignedAndReputable base policy on the system, which allows only files and apps that are authorized by the [Intelligent Security Graph Authorization](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph) which have known good state to run and anything else is blocked. - -### Unsigned version - -```powershell -New-WDACConfig -PolicyType SignedAndReputable -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) - -
- -### Signed version - -```powershell -New-WDACConfig -PolicyType SignedAndReputable -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-WDACConfig) - -```powershell -Deploy-SignedWDACConfig -CertPath "C:\Certificate.cer" -PolicyPaths "C:\Users\HotCakeX\SignedAndReputable.xml" -CertCN "App Control Certificate" -Deploy -``` - -* [Cmdlet info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig) - -
- -* The module creates ***SignedAndReputable App Control base Policy*** based on [AllowMicrosoft policy template](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/example-appcontrol-base-policies) with ***ISG*** related [rule options](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-1-app-control-for-business-policy---policy-rule-options). - -* The module also automatically starts the [Application Identity](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/configure-the-application-identity-service) (`AppIDSvc`) service required for [ISG Authorization](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph#enable-the-necessary-services-to-allow-wdac-to-use-the-isg-correctly-on-the-client) and sets its startup mode to Automatic. It's a protected service so can't be disabled or modified using Services snap-in. - -* ISG Authorization requires active Internet connection to communicate with the global ISG network. - -* Recommended to perform a reboot regardless of whether you are deploying signed or unsigned version of the "SignedAndReputable" App Control base policy. - -
- -After finishing deploying the SignedAndReputable base policy, if there is an app that is getting blocked and you want to allow it, you can create Supplemental policies to expand your base policy. To do that, you have multiple options. - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for Apps Already Installed - -The following commands use the `-Deploy` optional switch parameter, meaning after Supplemental policy creation, they are automatically deployed on the system. - -If you chose the Signed path, omit it from the commands and instead use the [Deploy-SignedWDACConfig](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Deploy-SignedWDACConfig) cmdlet to Sign and Deploy the Supplemental policy xml files. - -### Based on Signer Rules, Hashes, File Names Etc. - -```powershell -New-SupplementalWDACConfig -Normal -ScanLocation "C:\Program Files\Program" -SuppPolicyName "App's Name" -PolicyPath "C:\SignedAndReputable.xml" -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--normal) - -
- -### Based on File Path With One or More Wildcard Characters - -```powershell -New-SupplementalWDACConfig -FilePathWildCards -WildCardPath "C:\Program Files\Program\*" -SuppPolicyName "App's Name" -PolicyPath -"C:\SignedAndReputable.xml" -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--filepathwildcards) - -
- -### Based on an Installed Windows App’s Name - -```powershell -New-SupplementalWDACConfig -InstalledAppXPackages -PackageName "*App's name*" -SuppPolicyName "App's name" -PolicyPath "C:\SignedAndReputable.xml" -Deploy -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/New-SupplementalWDACConfig#new-supplementalwdacconfig--installedappxpackages) - -
- -horizontal super thin rainbow RGB line - -
- -## Creating Supplemental Policy for New App Installations or Apps Already Installed - -If the app you are trying to allow isn't installed, and when you try to install it you see a blocked/error message, you can use the following syntaxes to allow them to run and then automatically create Supplemental policy for them. - -These methods also work for apps that were installed prior to deploying the "SignedAndReputable" base policy and now you want to allow them to run by creating Supplemental policy for them. - -You can create a Supplemental policy for more than 1 app at a time by browsing for multiple apps' install directories using the commands below. - -
- -### Based on App’s Install Directory and Other Signals - Unsigned Version - -```powershell -Edit-WDACConfig -AllowNewApps -SuppPolicyName "App's Name" -PolicyPath "C:\SignedAndReputable.xml" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-WDACConfig#edit-wdacconfig--allownewapps) - -
- -### Based on App’s Install Directory and Other Signals - Signed Version - -```powershell -Edit-SignedWDACConfig -AllowNewApps -CertPath "C:\Certificate.cer" -SuppPolicyName "App's Name" -PolicyPath "C:\SignedAndReputable.xml" -CertCN "App Control Certificate" -``` - -* [Parameter info](https://github.com/HotCakeX/Harden-Windows-Security/wiki/Edit-SignedWDACConfig#edit-signedwdacconfig--allownewapps) - -
- -horizontal super thin rainbow RGB line - -
- -## Security Considerations - -One of the differences between using **ISG in an App Control policy** vs using **Smart App Control** (which also use ISG) is that App Control policy + ISG rule option passes along reputation from app installers to the binaries they write to disk, it can over-authorize files in some cases. For example, if the installer launches the app upon completion, any files the app writes during that first run will also be allowed. - -Smart App Control however doesn't do this, it will trust the installer file itself if it's trustworthy and subsequently checks the trustworthiness of any binaries the installer tries to use and write to the disk, if any of those binaries or components can't be verified or are malicious, they get blocked. - -Explained more in here: - -* [Security considerations with the ISG option](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/use-appcontrol-with-intelligent-security-graph#security-considerations-with-the-isg-option) - -* [Smart app control has blocked part of this app](https://support.microsoft.com/en-us/topic/smart-app-control-has-blocked-part-of-this-app-0729fff1-48bf-4b25-aa97-632fe55ccca2) - -
- -horizontal super thin rainbow RGB line - -
- -## What to Do When There Is an Update for an Allowed App? - -If you've created a Supplemental policy for an app that is already installed and now there is a newer version of that app available, you have multiple options: - -1. If the Supplemental policy that you created to allow that app is based on FilePath with wildcards, then the app can be updated and no change in policy is required. - -2. If the Supplemental policy is based on [PFN (Package Family Name)](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/manage-packaged-apps-with-appcontrol) of the app, available only for apps that use [MSIX](https://learn.microsoft.com/en-us/windows/msix/overview) installers, like some of the modern apps installed through Microsoft Store, then you don't need to take any action and the app will be updated without any issues. - -3. If the Supplemental policy is only based on the app's digital signature, which is common for well-made apps, then you don't need to take any further action. As long as the new version of the app has the same digital signature / developer identity, then it will be allowed to run. - -4. If the Supplemental policy is based on individual File Paths (in contrast to wildcard FilePath rules), or based on [FileName rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/select-types-of-rules-to-create#table-3--specificfilenamelevel-options), then most likely there is no need for any further action to be taken as long as the new app's version uses the same file names or the same file paths for its components. - -5. If the Supplemental policy is based on Hash of the app's files, either partially (mixed with signer rules) or entirely (for apps without any digital identity/signature) then all you have to do is to remove the deployed Supplemental policy and create a new Supplemental policy for the app using live audit mode in the module as explained above. Don't need to reboot immediately, but to finish the removal process of a Supplemental policy, whether it's signed or unsigned, a reboot will be eventually needed. - -