Smart App whitelist

[secmmo4]

Hi I used this script with the Smart App settings. However it seems some of my apps can't be loaded anymore. There is dll blocks and the software doesn't have their certificates or something registered.

Is there a way to whitelist or bypass Smart App control?

I am not sure this is the issue and there is no option with this script. https://stackoverflow.com/questions/48946680/how-to-avoid-the-windows-defender-smartscreen-prevented-an-unrecognized-app-fro

[HotCakeX]

Hi, That's by design:

• https://support.microsoft.com/en-us/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003
• https://support.microsoft.com/en-us/topic/smart-app-control-has-blocked-part-of-this-app-0729fff1-48bf-4b25-aa97-632fe55ccca2

At the moment, there is no way to allow a file or add it to exclusion for Smart App Control, I think a feature like that can come out later because the prerequisites are already there.

Smart App Control uses a specialized WDAC policy, you can deploy another WDAC policy yourself which will allow you to whitelist files and programs you choose. You can use my PowerShell module to do that easily.. I created videos and explanations, if you need help with it or have feature request/feedback I'll be happy to help. 😊

[HotCakeX]

I can give you my code signing certificate that has private keys (.pfx file), through email and you can use it to sign your WDAC policies. You will delete the certificate from your personal certificate stores after you're done, so no security risk there. The only risk is if i somehow manage to physically gain access to your computer and change the deployed WDAC policies with the ones I signed, which is very unlikely 😊

I created it in only few minutes on Windows server 2022 VM. You can do the same by following this guide:
https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Create-and-Deploy-a-Signed-WDAC-Policy-(Windows-Defender-Application-Control)

Basically copy paste the PowerShell commands and then use the GUI to create the certificate. As mentioned in the guide, you can set the expiry date to decades in the future so that you won't have to do this again for a very long time. If you're stuck at a specific step I can help out too.

Yes, other programs have digital signatures because their developers bought a globally recognized certificate from a certificate authority that is trusted by default in operation systems. They have to buy it because if they generate the certificate themselves then our computers wouldn't trust them since the CA will be unknown.

The best practice for companies, enterprises and individual users is to generate the certificate using Windows Server. You only need to buy a code signing certificate from a global certificate authority if you intend to distribute the file you are signing to people in the world.

I'll make a video for that guide too, soon like by tomorrow.

[HotCakeX]

Thank you, sent you them^^

[HotCakeX]

The video:
https://www.youtube.com/watch?v=vlu1HGuYPeg

[dennyamarojr]

About the Smart App Control, I think the only way is to use Azure to whitelist the apps. I see in a video from Microsoft using Azure or the cloud service to whitelist the programs, I try to find the video but unfortunately I don't find it =(

[HotCakeX]

Interesting, i'd definitely wanna watch that video whenever you find it! i don't know what it means to whitelist an app using Azure :3