Dynamic Code Security - 3114

[Confrigid]

We are making the push to require WDAC in our environment with Dynamic Code Security.
AppControl Manager has been wonderful in creating supplementals to get 95% of the products working, but I'm trying to determine workflow for the other 5% of apps that result in 3114 event logs.

It seems that the solve for this is either turning DCS off or adding the hash of the offending file to a supplemental?

Would it be possible to support 3114 event codes in AppControl Manager, as the file's SHA1 and SHA256 hashes are included in the Details of the event log?

[HotCakeX]

Hi, yes it's totally possible, the event has the necessary details for creating App Control rules so i'll add it to the app. Will try to do it in the next version.
DCS is recommended to be enabled so creating rules for offending files is the best move when encountering them.

[HotCakeX]

I just released a new update that includes this change, please update your app to use it: https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/AppControlManager-v2.0.67.0

[Confrigid]

Thanks for the update.
I've been looking forward to trying it out but I haven't seen anything come across the Microsoft Store since v2.0.661.0
Am I perhaps missing something?

[HotCakeX]

@Confrigid Yes, 4 more updates were released after that: https://github.com/HotCakeX/Harden-Windows-Security/releases

All of them are available on the Microsoft Store.

[Confrigid]

Gotcha, I do see the updates in releases which is what indicated I may be experiencing an issue. (Previously the release cadence was so quick that I would have to put ASR rules in place to allow the application to run due to it hitting the "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" rule.)

Currently we push AppControl Manager through Intune using the Windows Store (New) which apparently has not received any of the 4 updates since v2.0.661.0
Checking updates within the app doesn't flag anything as newer either.
Downloading directly from the Microsoft Store and attempting to install reports as having the latest version installed. (v2.0.661.0)

I grabbed a non-domain non-Intune Windows 11 laptop and installed the application from the store and it as well received v2.0.661.0

It seems like there is something else going on? Not knowledgeable enough about Microsoft Store to make guesses. (My current uneducated guess is that Microsoft Store sees 661 as a bigger number than 70 which is causing it to think 661 is the latest)

[HotCakeX]

@Confrigid Thanks for letting me know. I apologize about the update not showing up on Microsoft Store, it was my fault that the store was ranking an older version instead of the newest one. I fixed it and the update should become available in the Store soon.