// Understanding WDAC
Windows Defender Application Control (WDAC) provides a mechanism for controlling which applications can run on a Windows system. This is crucial for mitigating risks related to unauthorized software and malware execution. Using WDAC, you can create policies that allow or deny application execution based on file signatures, publishers, or paths.
WDAC policies can be complex, but PowerShell provides the necessary tools to navigate creation and auditing. This workflow assumes you are working with Windows 10 or later and are equipped with administrative privileges.
// Prerequisites
Before diving into policy creation, ensure the following:
- Windows 10 (Enterprise or Education) or Windows Server 2019/2022.
- Administrative access to the system.
- PowerShell 5.1 or later.
- Familiarity with the Get-WindowsFeature and Install-WindowsFeature cmdlets.
// Step 1: Enabling WDAC
To use WDAC, you must first enable the feature on your system. This can be done with the following command:
Install-WindowsFeature -Name Windows-Defender-Application-ControlConfirm that the feature has been successfully enabled by checking its status:
Get-WindowsFeature -Name Windows-Defender-Application-Control// Step 2: Creating a WDAC Policy
You can create a WDAC policy using the New-CIPolicy cmdlet. Here’s a simple example of creating a policy that allows only signed applications:
New-CIPolicy -FilePath "C:\Policies\WDACPolicy.xml" -UserMode -AllowUnsigned -Signer "YourPublisher" -Level Publisher- -FilePath: Specifies where to save the policy.
- -UserMode: Indicates that this policy applies to user mode applications.
- -AllowUnsigned: This flag permits unsigned applications, useful for testing.
- -Signer: Specifies a trusted publisher whose applications will be allowed.
After running this command, you can inspect the created policy:
Get-CIPolicy -FilePath "C:\Policies\WDACPolicy.xml"// Step 3: Converting the Policy to Binary Format
WDAC policies must be converted to binary format before deployment. Use the ConvertFrom-CIPolicy cmdlet:
ConvertFrom-CIPolicy -XmlFilePath "C:\Policies\WDACPolicy.xml" -BinaryFilePath "C:\Policies\WDACPolicy.bin"// Step 4: Deploying the Policy
To deploy the WDAC policy, you’ll need to use the Set-CIPolicy cmdlet. This applies the binary policy file:
Set-CIPolicy -PolicyPath "C:\Policies\WDACPolicy.bin"After applying the policy, check the status of WDAC to ensure it’s active:
Get-CIPolicy | Select-Object -Property PolicyStatus// Step 5: Auditing the WDAC Policy
Once the policy is in place, you can audit the application execution. WDAC logs are stored in the Event Viewer under Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational. Use PowerShell to extract relevant logs:
Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" | Where-Object { $_.Id -eq 3072 }This command retrieves events related to application execution. You may also want to filter logs based on specific criteria such as file names or execution status.
Common Mistakes
- Not testing policies in audit mode: Before enforcing a policy, always test it in audit mode to avoid unintentionally blocking legitimate applications.
- Forgetting to sign applications: Ensure that applications you intend to allow are signed by trusted publishers.
Defensive Implications
Implementing WDAC can significantly reduce the attack surface of a system. By allowing only pre-approved applications, you diminish the chances of malware execution. However, be cautious of the trade-offs; overly restrictive policies can disrupt business operations.
Checklist for WDAC Workflow
1. Enable WDAC feature on Windows. 2. Create a WDAC policy with New-CIPolicy. 3. Convert the policy to binary format with ConvertFrom-CIPolicy. 4. Deploy the policy using Set-CIPolicy. 5. Audit application execution via Event Viewer.
In this environment, WDAC serves as a powerful ally in your security posture, but like any tool, it requires careful handling.
--- // FIELDOPS REPORT AUTHORIZED BY: Alex J. //