-
|
Hello, First off, I would like to say thank you for creating the WDACConfig module, it is super helpful and easy to use! Unfortunately, I am experiencing this issue where the supplemental policy created through MDE Advanced Hunting is using only hashes for allow rules instead of Publisher type even though the files are signed. I have also watched your YouTube video on how to use WDACConfig module with Microsoft Defender for Endpoint (MDE) Advanced Hunting results to create Application Control policies and followed the steps as applicable. Is there any configuration I need to adjust or additional steps I should take to ensure all publisher fields are included when parsing from MDE Advanced Hunting events? Thank you for your support! |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 12 replies
-
|
Hi, The module first tries to create FilePublisher, if necessary details aren't available then attempts to create Publisher and lastly tries Hash level rules. If the CSV contains file's signatures (Publisher Name, Publisher TBS Hash, Issuer Name, Issuer TBS Hash) then Publisher level should be used. |
Beta Was this translation helpful? Give feedback.
-
|
I will definitely give that a shot -- thank you very much! |
Beta Was this translation helpful? Give feedback.
-
|
No problem, yw! :) |
Beta Was this translation helpful? Give feedback.
-
|
Hi again @HotCakeX, hope all is well! I was wondering if there is a way using the ConvertTo-WDACPolicy cmdlet when creating an allow rule to only have it create based on Issuer & Publisher and omit File Attribute? This option is available using the WDAC Wizard and it would be so helpful to have it on your WDACConfig module as well. Example from the Wizard: Shown above, when creating an allow rule for DellPair.exe - I am able to create it based on Issuer & Publisher only. Examples of xml generated from:
The reason I prefer this option is that any other file or executable under DigiCert EV Code Signing CA (SHA2) and IndiLogic LLC would be allowed using only one allow rule. Thanks, |
Beta Was this translation helpful? Give feedback.
-
|
Hi, when i designed that function, i made it to use the most secure levels as much as possible. So it first tries to use FilePublisher level, if the logs can't satisfy the requirements for it, then it falls back to Publisher level, if that can't be satisfied it tries to use LeafCertificate, and finally it will create Hash rules. I'm beginning to realize people (including you) want to use Publisher level primarily, especially in enterprise environments, so i will offer level selection in the command. The logics are already there, just need to take care of some minor technicalities to make it happen. Next version of the WDACConfig module will most likely offer it. |
Beta Was this translation helpful? Give feedback.
-
|
Awesome! Thank you for considering this enhancement. Having this level of granularity will be super nice. Do you have an estimated release date for the next update? I'm looking forward to it! |
Beta Was this translation helpful? Give feedback.
-
|
@a-shina Just released the update sorry couldn't give an estimation |
Beta Was this translation helpful? Give feedback.
-
|
@HotCakeX, thank you so much for the swift release! I’m excited to start using the new features. Much appreciated :) |
Beta Was this translation helpful? Give feedback.
-
|
You're welcome ^^ |
Beta Was this translation helpful? Give feedback.
Hi, when i designed that function, i made it to use the most secure levels as much as possible. So it first tries to use FilePublisher level, if the logs can't satisfy the requirements for it, then it falls back to Publisher level, if that can't be satisfied it tries to use LeafCertificate, and finally it will create Hash rules.
I'm beginning to realize people (including you) want to use Publisher level primarily, especially in enterprise environments, so i will offer level selection in the command. The logics are already there, just need to take care of some minor technicalities to make it happen. Next version of the WDACConfig module will most likely offer it.