Baseline Wizard : Microsoft WDAC Wizard (webapp-wdac-wizard.azurewebsites.net)

GitHub – microsoft/AaronLocker: Robust and practical application control for Windows

Whitelist

• Locations only Admins can Write too ( Program Files and PF x86\ WIndows )
• Whitelist Publishers
• Enable 18 – https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/select-types-of-rules-to-create

Advanced Hunting Defender to find Apps running outside if Allow List

DeviceProcessEvents
| where FolderPath !contains "Program Files"
| where FolderPath !contains "Onedrive"
| where FolderPath !contains "Teams"
| where FolderPath !contains "C:\\Windows\\"
| where FolderPath !contains "C:\\WindowsAzure\\"
| where FolderPath !contains "C:\\programdata\\"
| where FileName contains ".exe"
| where ProcessCommandLine contains ".exe"

Don’t create Policy Binary ( .cip ) over 350KB of you won’t be able to deploy via Intune!!!!

Update WDAC Audit Logs to Azure Log Analytics –Endpoint Manager and Windows Defender Application Control – stephanvdkruis.com

Endpoint Manager and Windows Defender Application Control – stephanvdkruis.com

Example Windows Defender Application Control (WDAC) base policies (Windows) | Microsoft Learn

Tools

• RefreshPolicy.exe download https://www.microsoft.com/en-us/download/details.aspx?id=102925
• CiTool ( CiTool is currently included as part of the Windows image in Windows 11 version 22H2. )

Company Portal Whitelisting Managed Apps

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer ( Deploy Default Policy Listed Here ) CANNOT BE DEPLOYED by Custom CSP , have to use powershell!!!! GitHub – ne8801/scripts

Remove WDAC Policy    
# Set PolicyId GUID to the PolicyId from your WDAC policy XML
    $PolicyId = "{a244370e-44c9-4c06-b551-f6016e563076}"

    # Initialize variables
    $SinglePolicyFormatPolicyId = "{A244370E-44C9-4C06-B551-F6016E563076}"
    $SinglePolicyFormatFileName = "\SiPolicy.p7b"
    $MountPoint =  $env:SystemDrive+"\EFIMount"
    $SystemCodeIntegrityFolderRoot = $env:windir+"\System32\CodeIntegrity"
    $EFICodeIntegrityFolderRoot = $MountPoint+"\EFI\Microsoft\Boot"
    $MultiplePolicyFilePath = "\CiPolicies\Active\"+$PolicyId+".cip"

    # Mount the EFI partition
    $EFIPartition = (Get-Partition | Where-Object IsSystem).AccessPaths[0]
    if (-Not (Test-Path $MountPoint)) { New-Item -Path $MountPoint -Type Directory -Force }
    mountvol $MountPoint $EFIPartition

    # Check if the PolicyId to be removed is the system reserved GUID for single policy format.
    # If so, the policy may exist as both SiPolicy.p7b in the policy path root as well as
    # {GUID}.cip in the CiPolicies\Active subdirectory
    if ($PolicyId -eq $SinglePolicyFormatPolicyId) {$NumFilesToDelete = 4} else {$NumFilesToDelete = 2}
    
    $Count = 1
    while ($Count -le $NumFilesToDelete) 
    {
           
        # Set the $PolicyPath to the file to be deleted, if exists
        Switch ($Count)
        {
            1 {$PolicyPath = $SystemCodeIntegrityFolderRoot+$MultiplePolicyFilePath}
            2 {$PolicyPath = $EFICodeIntegrityFolderRoot+$MultiplePolicyFilePath}
            3 {$PolicyPath = $SystemCodeIntegrityFolderRoot+$SinglePolicyFormatFileName}
            4 {$PolicyPath = $EFICodeIntegrityFolderRoot+$SinglePolicyFormatFileName}
        }

        # Delete the policy file from the current $PolicyPath
        Write-Host "Attempting to remove $PolicyPath..." -ForegroundColor Cyan
        if (Test-Path $PolicyPath) {Remove-Item -Path $PolicyPath -Force -ErrorAction Continue}

        $Count = $Count + 1
    }

    # Dismount the EFI partition
   mountvol $MountPoint /D

Double check this not being used in Intune

Event ID’s

Windows CodeIntegrity Operational log

Example Policy

https://github.com/pariswells/public-code/blob/master/WDAC.xml