AppControl Manager

AppControl Manager

AppControl Manager is a modern secure app that provides easy to use graphical user interface to manage App Control and Code Integrity on your device.

The short-term goal is for the AppControl manager to reach feature parity with the WDACConfig Powershell module, as fast as possible, and then to surpass it with new unique features and improvements.

Important

The AppControl Manager application is built publicly using a GitHub action and uploaded to the GitHub release. The action uses Artifact Attestation and SBOM (Software Bill of Materials) generation to comply with SLSA level 2 and security standards. The source code as well as the package is uploaded to Virus Total automatically. Also GitHub's CodeQL Advanced workflow with extended security model scans the entire repository.

How To Install or Update The App

Use the following PowerShell command as Admin, it will automatically download the latest MSIX file from this repository's release page and install it for you.

Tip

The app includes an update section that allows you to check for update and install the new version securely with just a press of a button. It is a very convenient and non-intrusive update experience because when the app is updated, it won't restart itself, instead it will wait for you to close it and the next time you open it you will be automatically using the new version.

(irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1')+'AppControl'|iex

Please feel free to open a discussion if you have any questions about the build process, security, how to use or have feedbacks. Source code on this repository

Preview of the App

Technical Details of The App

• Secure and transparent development and build process.
• Built using WinUI3 / XAML / C#.
• Built using the latest .NET.
• Powered by the WinAppSDK (formerly Project Reunion).
• Packaged with the modern MSIX format.
• Incorporates the Mica material design for backgrounds.
• Adopts the Windows 11 Fluent design system.
• Fast execution and startup time.
• 0 required dependency.
• 0 Third-party library or file used.
• 0 Telemetry or data collection.
• 0 Windows Registry changes.
• 100% clean uninstallation.
• 100% open-source and free to use.

Features Implemented So Far

• Create AppControl Policy
• Create Supplemental Policy
• System Information
• Configure Policy Rule Options
• Simulation
• Allow New Apps
• Build New Certificate
• Create Policy From Event Logs
• Create Policy From MDE Advanced Hunting
• Deploy App Control Policy
• Get Code Integrity Hashes
• Get Secure Policy Settings
• Update

More features will come very quickly in the near future.

Security

Security is paramount when selecting any application designed to safeguard your systems. The last thing you want is a security-focused tool that inadvertently expands your attack surface or one that doesn't prioritize security at its core.

AppControl Manager is engineered with a security-first approach from the ground up. It's crafted specifically for defense teams, yet its design has been rigorously shaped with a keen awareness of potential offensive strategies, ensuring resilience against emerging threats.

• The AppControl Manager does not rely on any 3rd party component or dependency. All the logics are built securely and specifically for the app.

• Any file(s) the AppControl Manager ever produces, uses or expects is only from an Administrator-protected location in C:\Program Files\WDACConfig.

• The AppControl Manager supports process mitigations / Exploit Protections such as: Blocking low integrity images, Blocking remote images, Blocking untrusted fonts, Disabling extension points, Export Address Filtering, Hardware enforced stack protection, Import Address Filtering, Validate handle usage, Validate stack integrity and so on.

• The AppControl Manager always uses the latest .NET and SDK versions, ensuring all the security patches released by Microsoft will be included.

About the Installation Process

The installation process for AppControl Manager is uniquely streamlined. When you execute the PowerShell one-liner command mentioned above, it initiates a file containing the AppControl function, which serves as the bootstrapper script. This script is thoroughly documented, with detailed explanations and justifications for each step, as outlined below:

• The latest version of the AppControl Manager MSIX package is securely downloaded from the GitHub release page, where it is built publicly with full artifact attestation and SBOMs.

• The SignTool.exe utility is sourced directly from Microsoft by retrieving the associated Nuget package, ensuring a trusted origin.

• A secure, on-device code-signing certificate is then generated. This certificate, managed by the Microsoft-signed SignTool.exe, is used to sign the MSIX package obtained from GitHub.

• The private keys of the certificate are encrypted with a randomly generated, 100-character password during the signing process, which lasts only a few seconds. Once signing is complete, the private keys are securely discarded, leaving only the public keys on the device to allow AppControl Manager to function properly on the system and prevent the certificate from being able to sign anything else.

• The entire process is designed to leave no residual files. Each time the script runs, any certificates from previous executions are detected and removed, ensuring a clean system.

• Finally, the AppControlManager.dll and AppControlManager.exe files are added to the Attack Surface Reduction (ASR) exclusions to prevent ASR rules from blocking these newly released binaries. Previous version exclusions are also removed from the ASRs exclusions list to maintain a clean, streamlined setup for the user.

Which URLs does the AppControl Manager Connect To?

Here is the complete list of all of the URLs the AppControl Manager application connects to (or is mentioned in the User Interface) with proper justification for each of them.

URL	Justification
https://api.nuget.org/v3-flatcontainer/	To access Microsoft NuGet repository to download SignTool.exe
https://aka.ms/VulnerableDriverBlockList	To download the Microsoft Recommended Drivers Block List
https://api.github.com/repos/MicrosoftDocs/windows-itpro-docs/commits	To check the latest commit details of the Microsoft Recommended Drivers Block List and display them to the user on the UI
https://raw.githubusercontent.com/MicrosoftDocs/windows-itpro-docs/refs/heads/public/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.md	Source for the Microsoft Recommended User-Mode Block Rules
https://raw.githubusercontent.com/MicrosoftDocs/windows-itpro-docs/refs/heads/public/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules.md	Source for the Microsoft Recommended Drivers Block Rules
https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/refs/heads/main/AppControl%20Manager/DownloadURL.txt	The file on this repository that contains the download link to the latest version of the AppControl Manager. That text file is updated via automated GitHub action workflow that securely builds and uploads the MSIX package to the GitHub releases.
https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/refs/heads/main/AppControl%20Manager/version.txt	The latest available version of the AppControl Manager application. That text file is updated via automated GitHub action workflow that securely builds and uploads the MSIX package to the GitHub releases.
https://github.com/HotCakeX/Harden-Windows-Security/wiki/Introduction	The link that opens in the GitHub documentations page in the app via the built-in WebView 2
https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol	The link that opens in the Microsoft documentations page in the app via the built-in WebView 2
https://github.com/HotCakeX/Harden-Windows-Security/issues/415	A link to one of the GitHub issues
https://github.com/HotCakeX/Harden-Windows-Security/releases	During the update process, this link that is for the GitHub releases will be displayed on the update page as a quick way to read the release notes
https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager	Will be displayed on the Update page when a new version is available and being downloaded
https://github.com/HotCakeX/Harden-Windows-Security/issues/new/choose	Link for the "Send Feedback" button at the bottom of the about section in settings
https://github.com/HotCakeX/Harden-Windows-Security	Mentioned in the Links section at the bottom of the About section in Settings
https://github.com/HotCakeX/Harden-Windows-Security/wiki/AppControl-Manager	Mentioned in the Links section at the bottom of the About section in Settings
https://spynetgirl.github.io/	Mentioned in the Links section at the bottom of the About section in Settings
https://www.youtube.com/@hotcakex	Mentioned in the Links section at the bottom of the About section in Settings
https://x.com/CyberCakeX	Mentioned in the Links section at the bottom of the About section in Settings