App Control Manager - Audit Log of MSI/Script in App Control and show in PE-Files scanning log if file is Kernel or User Mode

[SebCT]

Hello 😊

App Control Manager is really great and an amazing tool for App Control, but i didn't find the Audit or blocked events for MSI or Scripts - would it be possible to integrate this event log in the future?

And would it be possible to show in the scanning log of EXE/DLL (PE-Files) if the files are Kernel or User Mode Binaries?

[HotCakeX]

Hi, thank you!

All of them are already available in the app.

MSI and Scripts events are in both Event Logs scans and MDE Advanced Hunting scans.

The "Signing Scenario" column in the list views show whether a file is user or kernel mode. If the value is 0 it's kernel-mode, 1 is user mode. I suppose I can improve this area to make it clearer.

[SebCT]

Thanks a lot, that is also very nice with 0 and 1, it is okay for me - but of course if you could improve it for "Kernel-Mode" and "User-Mode" instead of the numbers this would be perfect 😊

Unfortunately, at least for me, the Event Log scan does not show any blocked MSIs or scripts (not even when in Audit Mode), but I’m following up on it and trying to figure out why that’s the case on my system. However, when I look directly into the AppLocker MSI/Script Event Log or use a custom PowerShell Module for parsing App Control Event logs, I do see the events from that category. I guess it could be a seperate problem/case on my machine, i will look into it, thanks in advance!

Update: i could track it down that the EventID 8029 under 'Microsoft-Windows-AppLocker/MSI and Script' is showing up in my Eventlog viewer, but not in App Control Manager. In my case the reason is a PowerShell Module psm1, which is blocked or not running in full language mode - not sure if this is necessary to show up in the event log scan of App Control Manager.

[HotCakeX]

For sure, i'll make that change and it'll be available in the next version!

These are all of the events that have the necessary information for creating Supplemental policy so they're the only ones AppControl Manager retrieves:

• For AppLocker: 8038, 8029, 8028
• For Code Integrity Operational: 3089, 3077, 3076

I can make the app retrieve any event but if they don't carry useful information it won't do any good.

[HotCakeX]

The update that contains improved signing scenario labels is released ^^
https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/AppControlManager-v2.0.45.0

[SebCT]

Thanks a lot! 👍🏻🙏🏻