diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index 615226657c..2b18eadcc2 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -5,7 +5,7 @@ ms.localizationpriority: medium ms.collection: - tier3 - must-keep -ms.date: 06/06/2023 +ms.date: 01/24/2024 ms.topic: article --- @@ -20,7 +20,7 @@ Microsoft has strict requirements for code running in kernel. So, malicious acto - Malicious behaviors (malware) or certificates used to sign malware - Behaviors that aren't malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel -Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the vulnerable driver blocklist, including updating a block rule once a driver vulnerability has been patched, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article. +Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the blocklist, including updating a block rule once a driver has been fixed, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article. > [!NOTE] > Blocking drivers can cause devices or software to malfunction, and in rare cases, lead to blue screen. The vulnerable driver blocklist is not guaranteed to block every driver found to have vulnerabilities. Microsoft attempts to balance the security risks from vulnerable drivers with the potential impact on compatibility and reliability to produce the blocklist. As always, Microsoft recommends using an explicit allow list approach to security wherever possible. @@ -39,7 +39,7 @@ With Windows 11 2022 update, the vulnerable driver blocklist is enabled by defa The blocklist is updated with each new major release of Windows, typically 1-2 times per year, including most recently with the Windows 11 2022 update released in September 2022. The most current blocklist is now also available for Windows 10 20H2 and Windows 11 21H2 users as an optional update from Windows Update. Microsoft will occasionally publish future updates through regular Windows servicing. -Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we've provided a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, you can use the XML provided below to create your own custom WDAC policies. +Customers who always want the most up-to-date driver blocklist can also use Windows Defender Application Control (WDAC) to apply the latest recommended driver blocklist contained in this article. For your convenience, we provide a download of the most up-to-date vulnerable driver blocklist along with instructions to apply it on your computer at the end of this article. Otherwise, use the following XML to create your own custom WDAC policies. ## Blocking vulnerable drivers using WDAC @@ -72,15 +72,17 @@ To check that the policy was successfully applied on your computer: ## Vulnerable driver blocklist XML > [!IMPORTANT] -> The policy listed below contains **Allow All** rules. If your version of Windows supports WDAC multiple policies, we recommend deploying this policy alongside any existing WDAC policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations). +> The following policy contains **Allow All** rules. If your version of Windows supports WDAC multiple policies, we recommend deploying this policy alongside any existing WDAC policies. If you do plan to merge this policy with another policy, you may need to remove the **Allow All** rules before merging it if the other policy applies an explicit allow list. For more information, see [Create a WDAC Deny Policy](/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy#single-policy-considerations). > [!NOTE] > To use this policy with Windows Server 2016, you must convert the policy XML on a device running a newer operating system. +The following recommended blocklist xml policy file can also be downloaded from the [Microsoft Download Center](https://aka.ms/VulnerableDriverBlockList). + ```xml - 10.0.25965.0 + 10.0.26025.0 {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -537,6 +539,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -653,6 +675,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -661,6 +687,24 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + @@ -868,6 +912,38 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1038,6 +1114,18 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + @@ -1182,42 +1270,98 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1240,6 +1384,14 @@ To check that the policy was successfully applied on your computer: + + + + + + + + @@ -1260,6 +1412,18 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + @@ -1363,35 +1527,45 @@ To check that the policy was successfully applied on your computer: + + + - - + + + + - + + + + + + @@ -1407,10 +1581,12 @@ To check that the policy was successfully applied on your computer: + + @@ -1425,27 +1601,39 @@ To check that the policy was successfully applied on your computer: + + - + + - + + + + + + + + + + @@ -1462,6 +1650,9 @@ To check that the policy was successfully applied on your computer: + + + @@ -1472,10 +1663,16 @@ To check that the policy was successfully applied on your computer: + + + + + + @@ -1506,6 +1703,7 @@ To check that the policy was successfully applied on your computer: + @@ -1525,12 +1723,14 @@ To check that the policy was successfully applied on your computer: + + + + - - @@ -1593,16 +1793,19 @@ To check that the policy was successfully applied on your computer: + + - - + + + @@ -1610,10 +1813,12 @@ To check that the policy was successfully applied on your computer: + + @@ -1630,9 +1835,11 @@ To check that the policy was successfully applied on your computer: + + @@ -1648,11 +1855,16 @@ To check that the policy was successfully applied on your computer: + + + + + @@ -1716,12 +1928,21 @@ To check that the policy was successfully applied on your computer: - + + + + + + + + + + @@ -1775,6 +1996,7 @@ To check that the policy was successfully applied on your computer: + @@ -1784,22 +2006,26 @@ To check that the policy was successfully applied on your computer: - + + - + + - + + - + + @@ -1964,11 +2190,13 @@ To check that the policy was successfully applied on your computer: + + @@ -2004,8 +2232,9 @@ To check that the policy was successfully applied on your computer: - + + @@ -2018,6 +2247,11 @@ To check that the policy was successfully applied on your computer: + + + + + @@ -2185,6 +2419,54 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -2309,10 +2591,13 @@ To check that the policy was successfully applied on your computer: + + + @@ -2342,6 +2627,7 @@ To check that the policy was successfully applied on your computer: + @@ -2369,10 +2655,13 @@ To check that the policy was successfully applied on your computer: + + + @@ -2389,17 +2678,22 @@ To check that the policy was successfully applied on your computer: + + + + + @@ -2881,6 +3175,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -2985,6 +3299,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -2993,6 +3311,24 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + @@ -3201,6 +3537,38 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3375,10 +3743,18 @@ To check that the policy was successfully applied on your computer: - - - - + + + + + + + + + + + + @@ -3523,38 +3899,98 @@ To check that the policy was successfully applied on your computer: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3577,6 +4013,14 @@ To check that the policy was successfully applied on your computer: + + + + + + + + @@ -3597,6 +4041,18 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + @@ -3681,6 +4137,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -3713,7 +4173,7 @@ To check that the policy was successfully applied on your computer: - 10.0.25965.0 + 10.0.26025.0 diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md index 6710d78572..5fb5ff24d3 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-wizard-parsing-event-logs.md @@ -3,7 +3,7 @@ title: Windows Defender Application Control Wizard WDAC Event Parsing description: Creating WDAC policy rules from the WDAC event logs and the MDE Advanced Hunting WDAC events. ms.localizationpriority: medium ms.topic: conceptual -ms.date: 02/01/2023 +ms.date: 01/24/2024 --- # Creating WDAC Policy Rules from WDAC Events in the Wizard @@ -21,11 +21,11 @@ As of [version 2.2.0.0](https://webapp-wdac-wizard.azurewebsites.net/archives.ht To create rules from the WDAC event logs on the system: -1. Select **Policy Editor** from the WDAC Wizard main page. +1. Select **Policy Editor** from the main page. 2. Select **Convert Event Log to a WDAC Policy**. 3. Select the **Parse Event Logs** button under the **Parse Event Logs from the System Event Viewer to Policy** header. - The Wizard will parse the relevant audit and block events from the CodeIntegrity (WDAC) Operational and AppLocker MSI and Script logs. You'll see a notification when the Wizard successfully finishes reading the events. + The Wizard parses the relevant audit and block events from the CodeIntegrity (WDAC) Operational and AppLocker MSI and Script logs. You see a notification when the Wizard successfully finishes reading the events. > [!div class="mx-imgBorder"] > [![Parse WDAC and AppLocker event log system events](../images/wdac-wizard-event-log-system.png)](../images/wdac-wizard-event-log-system-expanded.png) @@ -37,12 +37,12 @@ To create rules from the WDAC event logs on the system: To create rules from the WDAC `.EVTX` event logs files on the system: -1. Select **Policy Editor** from the WDAC Wizard main page. +1. Select **Policy Editor** from the main page. 2. Select **Convert Event Log to a WDAC Policy**. 3. Select the **Parse Log File(s)** button under the **Parse Event Log evtx Files to Policy** header. 4. Select the WDAC CodeIntegrity Event log EVTX file(s) from the disk to parse. - The Wizard will parse the relevant audit and block events from the selected log files. You'll see a notification when the Wizard successfully finishes reading the events. + The Wizard parses the relevant audit and block events from the selected log files. You see a notification when the Wizard successfully finishes reading the events. > [!div class="mx-imgBorder"] > [![Parse evtx file WDAC events](../images/wdac-wizard-event-log-files.png)](../images/wdac-wizard-event-log-files-expanded.png) @@ -57,7 +57,7 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que 1. Navigate to the Advanced Hunting section within the MDE console and query the WDAC events. **The Wizard requires the following fields** in the Advanced Hunting csv file export: ```KQL - | project Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA1, SHA256, IssuerName, IssuerTBSHash, PublisherName, PublisherTBSHash, AuthenticodeHash, PolicyId, PolicyName + | project-keep Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath, SHA1, SHA256, IssuerName, IssuerTBSHash, PublisherName, PublisherTBSHash, AuthenticodeHash, PolicyId, PolicyName ``` The following Advanced Hunting query is recommended: @@ -76,7 +76,7 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que | extend PolicyId = parsejson(AdditionalFields).PolicyID | extend PolicyName = parsejson(AdditionalFields).PolicyName // Keep only required fields for the WDAC Wizard - | project Timestamp,DeviceId,DeviceName,ActionType,FileName,FolderPath,SHA1,SHA256,IssuerName,IssuerTBSHash,PublisherName,PublisherTBSHash,AuthenticodeHash,PolicyId,PolicyName + | project-keep Timestamp,DeviceId,DeviceName,ActionType,FileName,FolderPath,SHA1,SHA256,IssuerName,IssuerTBSHash,PublisherName,PublisherTBSHash,AuthenticodeHash,PolicyId,PolicyName ``` 2. Export the WDAC event results by selecting the **Export** button in the results view. @@ -84,12 +84,12 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que > [!div class="mx-imgBorder"] > [![Export the MDE Advanced Hunting results to CSV](../images/wdac-wizard-event-log-mde-ah-export.png)](../images/wdac-wizard-event-log-mde-ah-export-expanded.png) -3. Select **Policy Editor** from the WDAC Wizard main page. +3. Select **Policy Editor** from the main page. 4. Select **Convert Event Log to a WDAC Policy**. 5. Select the **Parse Log File(s)** button under the "Parse MDE Advanced Hunting Events to Policy" header. 6. Select the WDAC MDE Advanced Hunting export CSV files from the disk to parse. - The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You'll see a notification when the Wizard successfully finishes reading the events. + The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You see a notification when the Wizard successfully finishes reading the events. > [!div class="mx-imgBorder"] > [![Parse the Advanced Hunting CSV WDAC event files](../images/wdac-wizard-event-log-mde-ah-parsing.png)](../images/wdac-wizard-event-log-mde-ah-parsing-expanded.png) @@ -99,14 +99,14 @@ To create rules from the WDAC events in [MDE Advanced Hunting](../operations/que ## Creating Policy Rules from the Events -On the "Configure Event Log Rules" page, the unique WDAC log events will be shown in the table. Event Ids, filenames, product names, the policy name that audited or blocked the file, and the file publisher are all shown in the table. The table can be sorted alphabetically by clicking on any of the headers. +On the "Configure Event Log Rules" page, the unique WDAC log events are shown in the table. Event Ids, filenames, product names, the policy name that audited or blocked the file, and the file publisher are all shown in the table. The table can be sorted alphabetically by clicking on any of the headers. To create a rule and add it to the WDAC policy: 1. Select an audit or block event in the table by selecting the row of interest. 2. Select a rule type from the dropdown. The Wizard supports creating Publisher, Path, File Attribute, Packaged App and Hash rules. 3. Select the attributes and fields that should be added to the policy rules using the checkboxes provided for the rule type. -4. Select the **Add Allow Rule** button to add the configured rule to the policy generated by the Wizard. The "Added to policy" label will be added to the selected row confirming that the rule will be generated. +4. Select the **Add Allow Rule** button to add the configured rule to the policy generated by the Wizard. The "Added to policy" label is shown in the selected row confirming that the rule will be generated. > [!div class="mx-imgBorder"] > [![Adding a publisher rule to the WDAC policy](../images/wdac-wizard-event-rule-creation.png)](../images/wdac-wizard-event-rule-creation-expanded.png)