AppControl Manager is a modern secure app that provides easy to use graphical user interface to mange App Control on your device.
-The goal is for AppControl manager to reach feature parity with the WDACConfig Powershell module as fast as possible and then to surpass it with additional features and improvements.
+AppControl Manager is a modern secure app that provides easy to use graphical user interface to mange App Control and Code Integrity on your device.
+The short-term goal is for the AppControl manager to reach feature parity with the WDACConfig Powershell module, as fast as possible, and then to surpass it with new unique features and improvements.
+Important
+The AppControl Manager application is built publicly using a GitHub action and uploaded to the GitHub release. The action uses Artifact Attestation and SBOM (Software Bill of Materials) generation to comply with SLSA level 2 and security standards. The source code as well as the package is uploaded to Virus Total automatically. Also GitHub's CodeQL Advanced workflow with extended security model scans the entire repository.
+Use the following PowerShell command as Admin, it will automatically download the latest MSIX file from this repository's release page and install it for you.
Tip
-The same command can be used to update the app whenever there is a new version available. In the future the updating functionality will be incorporated inside of the app.
+The app includes an update section that allows you to check for update and install the new version securely with just a press of a button. It is a very convenient and non-intrusive update experience because when the app is updated, it won't restart itself, instead it will wait for you to close it and the next time you open it you will be automatically using the new version.
(irm 'https://raw.githubusercontent.com/HotCakeX/Harden-Windows-Security/main/Harden-Windows-Security.ps1')+'AppControl'|iex
You can find the MSIX file in the GitHub releases section.
+Please feel free to open a discussion if you have any questions about the build process, security, how to use or have feedbacks.
Security is paramount when selecting any application designed to safeguard your systems. The last thing you want is a security-focused tool that inadvertently expands your attack surface or one that doesn't prioritize security at its core.
+AppControl Manager is engineered with a security-first approach from the ground up. It's crafted specifically for defense teams, yet its design has been rigorously shaped with a keen awareness of potential offensive strategies, ensuring resilience against emerging threats.
+The AppControl Manager does not rely on any 3rd party component or dependency.
+Any file(s) the AppControl Manager ever produces, uses or expects is only from an Administrator-protected location in C:\Program Files\WDACConfig.
The AppControl Manager supports process mitigations / Exploit Protections such as: Blocking low integrity images, Blocking remote images, Blocking untrusted fonts, Disabling extension points, Export Address Filtering, Hardware enforced stack protection, Import Address Filtering, Validate handle usage, Validate stack integrity and so on.
The installation process for AppControl Manager is uniquely streamlined. When you execute the PowerShell one-liner command mentioned above, it initiates a file containing the AppControl function, which serves as the bootstrapper script. This script is thoroughly documented, with detailed explanations and justifications for each step, as outlined below:
The latest version of the AppControl Manager MSIX package is securely downloaded from the GitHub release page, where it is built publicly with full artifact attestation and SBOMs.
+The SignTool.exe utility is sourced directly from Microsoft by retrieving the associated Nuget package, ensuring a trusted origin.
A secure, on-device code-signing certificate is then generated. This certificate, managed by the Microsoft-signed SignTool.exe, is used to sign the MSIX package obtained from GitHub.
The private keys of the certificate are encrypted with a randomly generated, 100-character password during the signing process, which lasts only a few seconds. Once signing is complete, the private keys are securely discarded, leaving only the public keys on the device to allow AppControl Manager to function properly on the system and prevent the certificate from being able to sign anything else.
+The entire process is designed to leave no residual files. Each time the script runs, any certificates from previous executions are detected and removed, ensuring a clean system.
+Finally, the AppControlManager.dll and AppControlManager.exe files are added to the Attack Surface Reduction (ASR) exclusions to prevent ASR rules from blocking these newly released binaries. Previous version exclusions are also removed from the ASRs exclusions list to maintain a clean, streamlined setup for the user.
Get-BlockedPackets Function¶
+#Requires -RunAsAdministrator
+#Requires -Version 7.4
+Function Get-BlockedPackets {
+ Begin {
+ [System.Diagnostics.Eventing.Reader.EventLogRecord[]]$Events = Get-WinEvent -FilterHashtable @{LogName = 'Security'; ID = 5152 }
+ [System.Object[]]$Outputs = @()
+
+ # Create an empty hashtable to store the firewall rule names and display names
+ [System.Collections.Hashtable]$FirewallGroupPolicy = @{}
+
+ # Loop through each firewall rule from the local policy store (for Firewall rules that are stored in Group Policy)
+ foreach ($Rule in Get-NetFirewallRule -PolicyStore localhost) {
+ # Add a new entry to the hashtable with the rule name as the key and the display name as the value
+ $FirewallGroupPolicy[$Rule.name] = $Rule.DisplayName
+ }
+
+ # Loop through each local firewall rule (for Firewall rules that are defined locally in Windows Defender Firewall with Advanced Security)
+ foreach ($Rule in Get-NetFirewallRule) {
+ # Add a new entry to the hashtable with the rule name as the key and the display name as the value
+ $FirewallGroupPolicy[$Rule.name] = $Rule.DisplayName
+ }
+
+ # Create a hashtable of partition numbers and their associated drive letters
+ [System.Collections.Generic.Dictionary[string, string]]$DriveLetterMappings = @{}
+
+ # Get all partitions and filter out the ones that don't have a drive letter and then add them to the hashtable with the partition number as the key and the drive letter as the value
+ foreach ($Drive in (Get-Partition | Where-Object -FilterScript { $_.DriveLetter })) {
+ $DriveLetterMappings[$Drive.PartitionNumber] = $Drive.DriveLetter
+ }
+
+ # Define the regex pattern for the device path
+ [string]$Pattern = '\\Device\\HarddiskVolume(\d+)\\(.*)$'
+ }
+ Process {
+
+ # Loop through each event in the $Events array
+ foreach ($Event in $Events) {
+
+ # Convert the event to an XML document
+ $Xml = [System.Xml.XmlDocument]$Event.ToXml()
+
+ # Pipe the data elements of the event to the next command
+ $Xml.event.eventdata.data |
+
+ # For each data element, do the following
+ ForEach-Object -Begin {
+ [System.Collections.Hashtable]$Hash = @{ TimeCreated = [System.DateTime]$Xml.Event.System.TimeCreated.SystemTime }
+ } -Process {
+ # Add the name and text of the data element as another key-value pair to the hashtable
+ $Hash[$_.name] = $_.'#text'
+ } -End {
+ # Convert the hashtable to a custom object and pipe it to the next command
+ [pscustomobject]$Hash
+ } |
+ # Filter out the objects that have a filter origin property matching any of the specified strings
+ Where-Object -Property FilterOrigin -NotMatch 'Stealth|Unknown|Query User Default|WSH Default' | ForEach-Object -Process {
+
+ # If the filter origin is in the hashtable keys
+ if ($_.FilterOrigin -in $FirewallGroupPolicy.Keys) {
+ # Replace the filter origin with the display name of the firewall rule from the hashtable
+ $_.FilterOrigin = $FirewallGroupPolicy[$_.FilterOrigin]
+ }
+
+ # Create a hashtable with the protocol numbers and names
+ [System.String]$ProtocolName = @{ 6 = 'TCP'; 17 = 'UDP' }[[System.Int32]$_.Protocol]
+
+ # If the protocol number is not in the hashtable, keep it as it is, otherwise replace it with the protocol name
+ $_.Protocol = if (-not $ProtocolName) { $_.Protocol } else { $ProtocolName }
+
+ # If the direction is equal to '%%14592', set it to 'Outbound', otherwise set it to 'Inbound'
+ $_.Direction = $_.Direction -eq '%%14592' ? 'Outbound' : 'Inbound'
+
+ # If the application matches the pattern, replace the device path with the drive letter
+ if ($_.Application -match $Pattern) {
+ [System.Int64]$HardDiskVolumeNumber = $Matches[1]
+ [System.String]$RemainingPath = $Matches[2]
+ [PSCustomObject]$GetLetter = $DriveLetterMappings[$HardDiskVolumeNumber]
+ [System.IO.FileInfo]$UsablePath = [System.IO.Path]::Combine("$GetLetter`:", $RemainingPath)
+ $_.Application = $_.Application -replace $Pattern, $UsablePath
+ }
+
+ # Add the modified object to the $Outputs array
+ $Outputs += $_ | Select-Object -Property Application, SourcePort, Protocol, SourceAddress, DestPort, TimeCreated, Direction, DestAddress, ProcessId , FilterOrigin
+ }
+ }
+ }
+ End {
+ Return $Outputs
+ }
+}
+Get-BlockedPackets
+This code assumes you've already used the Harden Windows Security Module and the event logs custom views exist on your machine.
-In this example, any logs generated for Exploit Protection is displayed in real time on PowerShell console. You can modify and improve the displayed output more according to your needs.
-Get-EventData Function¶If you don't want the real time mode and just want to get the logs one time, you can use the following code
-# Load the XML content from a file or a string
-$xml = [xml](Get-Content -Path 'C:\ProgramData\Microsoft\Event Viewer\Views\Hardening Script\Exploit Protection Events.xml')
-
-# Get the QueryList element using XPath
-$queryList = $xml.SelectSingleNode("//QueryList")
-
-# Convert the QueryList element to a string
-$queryListString = $queryList.OuterXml
-
-$Events = Get-WinEvent -FilterXml $queryListString -Oldest
-$Events | Format-Table -AutoSize
+# Load the XML content from a file or a string
+$xml = [xml](Get-Content -Path 'C:\ProgramData\Microsoft\Event Viewer\Views\Hardening Script\Exploit Protection Events.xml')
+
+# Get the QueryList element using XPath
+$queryList = $xml.SelectSingleNode("//QueryList")
+
+# Convert the QueryList element to a string
+$queryListString = $queryList.OuterXml
+
+$Events = Get-WinEvent -FilterXml $queryListString -Oldest
+$Events | Format-Table -AutoSize
@@ -2994,7 +3022,7 @@
- 2024-09-04
+ 2024-10-27
@@ -3348,7 +3376,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/Group Policy/index.html b/Miscellaneous/Group Policy/index.html
index 84439e3..78a88c3 100644
--- a/Miscellaneous/Group Policy/index.html
+++ b/Miscellaneous/Group Policy/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -1486,6 +1486,21 @@
+
+
@@ -3086,6 +3101,21 @@
+
+
@@ -3284,10 +3314,19 @@ Get-ProvisioningPackage -AllInstalledPackages
Download Windows Configuration Designer from Microsoft Store or from Windows ADK or from Windows insiders ADK, to easily create provisioning packages for your device(s)
You can use gpresult to see more info about Group Policies on your computer
# What policies are applied to your computer:
@@ -3301,6 +3340,111 @@ How to Get All CIM Namespaces, Their Methods and Properties in PowerShell¶
+# Defining the custom class for CIM instance classes
+class CimClassInfo {
+ [System.String]$ClassName
+ [System.Collections.Generic.List[System.String]]$Methods
+ [System.Collections.Generic.List[System.String]]$Properties
+
+ CimClassInfo([System.String]$ClassName) {
+ $this.ClassName = $ClassName
+ $this.Methods = [System.Collections.Generic.List[System.String]]::new()
+ $this.Properties = [System.Collections.Generic.List[System.String]]::new()
+ }
+}
+
+# Defining the custom class for namespaces
+class NamespaceInfo {
+ [System.String]$NamespaceName
+ [System.Collections.Generic.List[CimClassInfo]]$Classes
+
+ NamespaceInfo([System.String]$NamespaceName) {
+ $this.NamespaceName = $NamespaceName
+ $this.Classes = [System.Collections.Generic.List[CimClassInfo]]::new()
+ }
+}
+
+function Get-NamespaceInfo {
+ [OutputType([System.Collections.Generic.List[NamespaceInfo]])]
+ param (
+ [System.String]$RootNamespace = 'root',
+ [System.String]$OutputFile = $null
+ )
+
+ # Initialize a list to hold NamespaceInfo objects
+ $NamespaceInfos = [System.Collections.Generic.List[NamespaceInfo]]::new()
+
+ # Initialize a list to hold namespaces
+ $Namespaces = [System.Collections.Generic.List[System.String]]::new()
+ $Namespaces.Add($RootNamespace)
+
+ # Initialize an index to track the current namespace
+ $Index = 0
+
+ # Loop through namespaces
+ while ($Index -lt $Namespaces.Count) {
+ # Get the current namespace
+ $CurrentNamespace = $Namespaces[$Index]
+
+ # Create a new NamespaceInfo object
+ $NamespaceInfo = [NamespaceInfo]::new($CurrentNamespace)
+
+ # Get child namespaces of the current namespace
+ $ChildNamespaces = Get-CimInstance -Namespace $CurrentNamespace -ClassName __Namespace
+
+ # Add child namespaces to the list
+ foreach ($ChildNamespace in $ChildNamespaces.Name) {
+ $Namespaces.Add("$CurrentNamespace\$ChildNamespace")
+ }
+
+ # Get classes in the current namespace
+ $Classes = Get-CimClass -Namespace $CurrentNamespace
+
+ # Add classes to the NamespaceInfo object
+ foreach ($Class in $Classes) {
+ # Create a new CimClassInfo object
+ $CimClassInfo = [CimClassInfo]::new($Class.CimClassName)
+
+ # Get methods of the class
+ $Methods = ($Class.CimClassMethods).Name
+
+ # Add methods to the CimClassInfo object
+ foreach ($Method in $Methods) {
+ $CimClassInfo.Methods.Add($Method)
+ }
+
+ # Get properties of the class
+ $Properties = ($Class.CimClassProperties).Name
+
+ # Add properties to the CimClassInfo object
+ foreach ($Property in $Properties) {
+ $CimClassInfo.Properties.Add($Property)
+ }
+
+ # Add the CimClassInfo object to the NamespaceInfo object
+ $NamespaceInfo.Classes.Add($CimClassInfo)
+ }
+
+ # Add the NamespaceInfo object to the list
+ $NamespaceInfos.Add($NamespaceInfo)
+
+ # Move to the next namespace
+ $Index++
+ }
+
+ # Export to JSON too if OutputFile is specified
+ if ($OutputFile) {
+ $NamespaceInfos | ConvertTo-Json -Depth 100 | Out-File -FilePath $OutputFile
+ }
+
+ return $NamespaceInfos
+}
+
+$NamespaceInfo = Get-NamespaceInfo -RootNamespace 'root' -OutputFile 'NamespaceInfo.json'
+$NamespaceInfo
+
+
@@ -3323,7 +3467,7 @@
- 2024-09-04
+ 2024-10-27
@@ -3677,7 +3821,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell/index.html b/Miscellaneous/How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell/index.html
index 058f2c7..f4b0e6b 100644
--- a/Miscellaneous/How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell/index.html
+++ b/Miscellaneous/How to Detect Changes in User and Local Machine Certificate Stores in Real Time Using PowerShell/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3204,7 +3204,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/How to compact your OS and free up extra space/index.html b/Miscellaneous/How to compact your OS and free up extra space/index.html
index c0904fc..f0d9407 100644
--- a/Miscellaneous/How to compact your OS and free up extra space/index.html
+++ b/Miscellaneous/How to compact your OS and free up extra space/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3159,7 +3159,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/Hyper V/index.html b/Miscellaneous/Hyper V/index.html
index c065c9d..0cbd8e6 100644
--- a/Miscellaneous/Hyper V/index.html
+++ b/Miscellaneous/Hyper V/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3690,7 +3690,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus/index.html b/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus/index.html
index 18886ce..ca7d0c5 100644
--- a/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus/index.html
+++ b/Miscellaneous/Only a Small Portion of The Windows OS Security Apparatus/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -4654,7 +4654,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/Overrides for Microsoft Security Baseline/index.html b/Miscellaneous/Overrides for Microsoft Security Baseline/index.html
index 1cba490..2e1da7e 100644
--- a/Miscellaneous/Overrides for Microsoft Security Baseline/index.html
+++ b/Miscellaneous/Overrides for Microsoft Security Baseline/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3445,7 +3445,7 @@ Cookie Consent
-
+
diff --git a/Miscellaneous/Things to do for clean installing Windows/index.html b/Miscellaneous/Things to do for clean installing Windows/index.html
index a1781e6..27789d5 100644
--- a/Miscellaneous/Things to do for clean installing Windows/index.html
+++ b/Miscellaneous/Things to do for clean installing Windows/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3244,7 +3244,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/Basic PowerShell tricks and notes Part 2/index.html b/PowerShell/Basic PowerShell tricks and notes Part 2/index.html
index 5801c41..5931cf0 100644
--- a/PowerShell/Basic PowerShell tricks and notes Part 2/index.html
+++ b/PowerShell/Basic PowerShell tricks and notes Part 2/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3920,7 +3920,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/Basic PowerShell tricks and notes Part 3/index.html b/PowerShell/Basic PowerShell tricks and notes Part 3/index.html
index 48b74d7..0d9c49f 100644
--- a/PowerShell/Basic PowerShell tricks and notes Part 3/index.html
+++ b/PowerShell/Basic PowerShell tricks and notes Part 3/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3515,7 +3515,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/Basic PowerShell tricks and notes Part 4/index.html b/PowerShell/Basic PowerShell tricks and notes Part 4/index.html
index f0ae022..3183226 100644
--- a/PowerShell/Basic PowerShell tricks and notes Part 4/index.html
+++ b/PowerShell/Basic PowerShell tricks and notes Part 4/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3545,7 +3545,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/Basic PowerShell tricks and notes Part 5/index.html b/PowerShell/Basic PowerShell tricks and notes Part 5/index.html
index 7b6aa59..a8a363c 100644
--- a/PowerShell/Basic PowerShell tricks and notes Part 5/index.html
+++ b/PowerShell/Basic PowerShell tricks and notes Part 5/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3642,7 +3642,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/Basic PowerShell tricks and notes/index.html b/PowerShell/Basic PowerShell tricks and notes/index.html
index e5dc52d..6289d34 100644
--- a/PowerShell/Basic PowerShell tricks and notes/index.html
+++ b/PowerShell/Basic PowerShell tricks and notes/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3882,7 +3882,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time/index.html b/PowerShell/How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time/index.html
index 3e85591..088015a 100644
--- a/PowerShell/How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time/index.html
+++ b/PowerShell/How To Access All Stream Outputs From Thread Jobs In PowerShell In Real Time/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3222,7 +3222,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell/index.html b/PowerShell/How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell/index.html
index be7936c..eadb334 100644
--- a/PowerShell/How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell/index.html
+++ b/PowerShell/How To Asynchronously Access All Stream Outputs From Background Jobs In PowerShell/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3229,7 +3229,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/How To Use Reflection And To Protect against using internal & private C# methods in PowerShell/index.html b/PowerShell/How To Use Reflection And To Protect against using internal & private C# methods in PowerShell/index.html
index 13ce17f..a715d98 100644
--- a/PowerShell/How To Use Reflection And To Protect against using internal & private C# methods in PowerShell/index.html
+++ b/PowerShell/How To Use Reflection And To Protect against using internal & private C# methods in PowerShell/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3345,7 +3345,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/PowerShell Best Practices/index.html b/PowerShell/PowerShell Best Practices/index.html
index d0e97c2..d01523a 100644
--- a/PowerShell/PowerShell Best Practices/index.html
+++ b/PowerShell/PowerShell Best Practices/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3468,7 +3468,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/Powershell Dynamic Parameters and How to Add Them to the Get-Help Syntax/index.html b/PowerShell/Powershell Dynamic Parameters and How to Add Them to the Get-Help Syntax/index.html
index e56f8fa..ff86ef2 100644
--- a/PowerShell/Powershell Dynamic Parameters and How to Add Them to the Get-Help Syntax/index.html
+++ b/PowerShell/Powershell Dynamic Parameters and How to Add Them to the Get-Help Syntax/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3209,7 +3209,7 @@ Cookie Consent
-
+
diff --git a/PowerShell/RunSpaces In PowerShell/index.html b/PowerShell/RunSpaces In PowerShell/index.html
index e8bd5c7..c4abf63 100644
--- a/PowerShell/RunSpaces In PowerShell/index.html
+++ b/PowerShell/RunSpaces In PowerShell/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3333,7 +3333,7 @@ Cookie Consent
-
+
diff --git a/WDAC/Application Control WDAC Frequently Asked Questions FAQs/index.html b/WDAC/Application Control WDAC Frequently Asked Questions FAQs/index.html
index dc4a4a7..6869bb7 100644
--- a/WDAC/Application Control WDAC Frequently Asked Questions FAQs/index.html
+++ b/WDAC/Application Control WDAC Frequently Asked Questions FAQs/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3393,7 +3393,7 @@ Cookie Consent
-
+
diff --git a/WDAC/EKUs in WDAC, App Control for Business, Policies/index.html b/WDAC/EKUs in WDAC, App Control for Business, Policies/index.html
index 28bfb42..e891ad9 100644
--- a/WDAC/EKUs in WDAC, App Control for Business, Policies/index.html
+++ b/WDAC/EKUs in WDAC, App Control for Business, Policies/index.html
@@ -20,7 +20,7 @@
-
+
@@ -28,7 +28,7 @@
-
+
@@ -3229,6 +3229,7 @@ Common EKUs in App Control Policies
<EKU ID="ID_EKU_STORE" FriendlyName="Windows Store - 1.3.6.1.4.1.311.76.3.1" Value="010a2b0601040182374c0301" />
<EKU ID="ID_EKU_DCODEGEN" FriendlyName="Dynamic Code Generation - 1.3.6.1.4.1.311.76.5.1" Value="010A2B0601040182374C0501" />
<EKU ID="ID_EKU_AM" FriendlyName="AntiMalware - 1.3.6.1.4.1.311.76.11.1" Value="010a2b0601040182374c0b01" />
+<EKU ID="ID_EKU_IUM" FriendlyName="Isolated User Mode - 1.3.6.1.4.1.311.10.3.37" Value="010A2B0601040182370A0325" />