Can't create custom rule from ECC-signed file

[PanAlexandr]

Hello,

I use WDAC Wizard 2.1.0.1.22 and when I try to add custome rule:

1. Policy creator - Single policy format - Default Windows Mode
2. Default Configure Policy Template
3. Add Custome Rule
   
4. Wizard generate XML-file but it doesn't include rule wich I try to add in step 3.

[jgeurten]

@PanAlexandr Can you please share the zipped exe and the log file generated from this session? It would be stored on disk as %AppDataLocal%\Temp\WDACWizard\Temp

I was able to create a signer rule for an older version of this file (1.10.2.297)

<Signer Name="DigiCert EV Code Signing CA (SHA2)" ID="ID_SIGNER_S_1_0_0">
  <CertRoot Type="TBS" Value="EEC58131DC11CD7F512501B15FDBC6074C603B68CA91F7162D5A042054EDB0CF" />
  <CertPublisher Value="KnowBe4 Inc." />
</Signer>

[PanAlexandr]

@jgeurten Thank you for support!
Here the zipped exe and logs
PhishAlertButtonSetup.zip
Old version works fine but KnowBe4 update it and we didn't have intermidiate certificate which issued KnowBe4's certificate in the "Intermediate CA" store and get error "Issuing CA" was N\A (like that)

When we added certificate "DigiCert Global G3 Code Signing ECC SHA384 2021 CA1" to "Intermediate CA" store (for user and for local computer) the issue has gone but WDAC wizard doesn't add the rule to policy XML-file.
Thank you in advance!

[jgeurten]

@PanAlexandr I have diagnosed the issue as a bug in the underlying PowerShell module (New-CIPolicyRule -Level Publisher -DriverFilePath ). I will not be able to fix this in the Wizard until the PowerShell bug is fixed. The bug has been filed on the Microsoft team. All ECC SHA384 signed files appear to have this issue

Thanks for bringing this to my attention.

[PanAlexandr]

@jgeurten Thank you for support! So, we can only wait for fixes in the PowerShell module. For my part, can I somehow speed up this process?
Thank you in advance!

[PanAlexandr]

@jgeurten Maybe you know some workaround how we can add such publisher to WDAC-policy?

[jgeurten]

@PanAlexandr I just learned it's actually a limitation of WDAC. WDAC does not support creating rules off ECC certificates and policies cannot be signed with ECC certificates.