WDAC and DLLs

[JamesBowtell]

Hey,

I'm starting on my journey to enable WDAC for our client desktops (Windows 11). I'm using HotCakeX amazing AppControl Manager tool, which is making creating policies incredibly easy.

I am hitting a problem with parent executables calling DLLs from another location. Whats the best way to tackle this...?

I do not have Dynamic Code Security enabled and DLLs are still being blocked. It looks like most of these DLLs are stored in the Global Assembly Cache (GAC) 'C:\windows\assembly'

Any advice or guidance would be greatly appreciated.

Kind Regards

James

[HotCakeX]

Hi,
Thank you ^^

When Dynamic Code Security is enabled it does its job and authorizes the required DLLs for .NET apps that use JIT. Do you see any logs in the event viewer or is there a particular app that is having problem that i can investigate? feel free to share that info in email/teams if dont wanna post publicly.

[HotCakeX]

I'm glad to know that ^^

Sure, you can expect that feature in the next version! As to why it's currently not supported, it's most likely a technical issue. Historically, things like this that have been on the known issues list were fixed gradually so we can expect this one to be fixed too in the future.

You can do exactly what you mentioned 😊

Using MDE (Microsoft Defender for Endpoint) and Intune. Please check out these articles for more info about them:

• How to Use Microsoft Defender for Endpoint Advanced Hunting With App Control
• How To Upload App Control Policies To Intune Using AppControl Manager
• Create Policy From MDE Advanced Hunting
• Deploy App Control Policy

[krunph]

Hi @HotCakeX , Apologise for jumping in to this thread :p
I have this event where ScriptControl_###.dll is getting blocked. it seems a dll file created by Crowdstrike

`ParameterXml

66\Device\HarddiskVolume3\Windows\System32\ScriptControl64_19205.dll0x80000000771\Device\HarddiskVolume3\Program Files\CrowdStrike\CSFalconContainer.exe EventData 66\Device\HarddiskVolume3\Windows\System32\ScriptControl64_19205.dll0x80000000771\Device\HarddiskVolume3\Program Files\CrowdStrike\CSFalconContainer.exe`

Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\ScriptControl64_19205.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Is there a way to whitelist all dll files in a specific folder? e.g C:\Windows\System32*.dll

thanks in advance

[HotCakeX]

Hi @krunph

Yes, you can use the Supplemental policy creation page with pattern matching file rules to authorize those files:
https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Supplemental-App-Control-Policy#create-a-supplemental-policy-based-on-custom-pattern-based-file-rules

[krunph]

Hi @HotCakeX ,
I tried whitelisting this specific file, but it keeps getting blocked. I’ve also noticed the same issue with other applications where .dll files are being blocked, but I’m still able to open the apps. It seems like these files might not be too important, but I'm not entirely sure.

[HotCakeX]

You can allow any files in your policy using AppControl Manager, no exceptions.

Try pressing the scan button in this page: https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Policy-From-Event-Logs

and it will show you any blocked or audited Code Integrity/AppLocker events.