K-AppControl
Allow only what should run
K-AppControl first observes the applications actually used, then switches to blocking everything that is not approved, relying on Windows' native mechanisms.
The problem
Blocking the unknown is safer than hunting the malicious, but a bad list blocks work. The key is a serious observation period.
What the module does
Observation mode
Inventory of what runs over several weeks, without blocking anything.
Fine-grained rules
Allow by fingerprint, signed publisher, path or category.
WDAC policies
Generation of Windows Defender Application Control policies from the observations.
Gradual switch
Move to blocking group by group, with the option to go back.
How it works
Observe
The agent lists what actually runs.
Validate
You approve the proposed list.
Block
Everything else is refused and logged.
What you should know
- The module is in development; generation of WDAC policies is partly built.
Frequently asked questions
Questions about this module
How long does observation last?
We recommend at least two weeks, to cover occasional uses such as payroll or month-end closing.
Want to try this module?
The pilot programme gives you access to modules as they are delivered, free of charge and with no commitment.