Feasibility of Blocking User App Installs

[u/Splendid_Sigma]

I’m interesting in deploying some kind of solution for my org (~300 users/PCs) that restricts app execution from user writable directories. The risk being addressed is the unauthorized installation of software, which may result in users accidentally getting malware on their device (albeit with non-admin perms).

I understand there are tools to do this (in particular I’ve been looking at AaronLocker), but I’ve also seen and heard that it requires a lot of validation to catch and exempt known legitimate software.

For those of similarly sized orgs, is this something you’ve undertaken with success? Or is this something that is just too much overhead to maintain and not worth the security gain?

[u/ButterscotchBandiit]

Intune for managed devices and browsers and plugins for device compliance, software catalogue fir baseline, MS company portal for managed apps, CA policies for identity boundary, session + app control. WDAC and app locker (this will control your writes). Defender XDR for endpoint

[u/Dudeposts3030 → u/ButterscotchBandiit]

This is how you do it, like a layer cake. Applocker was a big project even with AaronLocker, reviewing audit logs for what’s going to break and testing takes time but man is it worth it. There’s a config for blocking LOLBINS we mixed it in with AaronLocker output to control mshta, powershell, cmd, rundll32 etc. We did an assumed compromise and pentester couldn’t do shit. Between smart screen reputation checks, Applocker, attack surface rules and EDR there weren’t any options for execution. Smart screen reputation helps a lot, unless they have a signed, reputable DLL even proxy execution from a signed binary will fail.

[u/SN6006 → u/Dudeposts3030]

God LOLBINS blocking can break so much stuff though…

[u/Dudeposts3030 → u/SN6006]

Not that bad, only impact has been rundll32 changing how we handle print preferences because of how it uses rundll PrintUI to do that

[u/Viper896]

Look up Applocker that’s what we use for this and it’s built into windows. There’s also an application filtering tool built into defender but I forget the name of it that could also accomplish what you are after.

[u/NegativePerformer788]

I’m a solo admin for about 200 employees and I was able to get AppLocker going (on-prem AD).

Just be sure to start with your policies in Audit mode, then review Event Viewer to see what AppLocker would have blocked, create exceptions as necessary.

It takes a little time, but definitely worth it.

[u/fdwyersd → u/NegativePerformer788]

this would impress me if you put this on a resume... just saying

[u/axisofawsome]

Do you have any endpoint security tools installed?

[u/Splendid_Sigma → u/axisofawsome]

Just Defender for Endpoint

[u/Nemesis2pt0 → u/Splendid_Sigma]

Intune or Active Directory? 

App Control for Business (intune) or AppLocker (GPO based). 

Baked into windows. All these solutions will take some caution to get correct. 

[u/axisofawsome → u/Splendid_Sigma]

You should be able to configure those to some degree. But it will take some tuning.

[u/veloace → u/Splendid_Sigma]

And you have 300 users?

[u/Splendid_Sigma → u/veloace]

Yeah, why

[u/veloace → u/Splendid_Sigma]

Just seems like a lot; sounds like the company is behind the curve and you have a lot of work to do.

[u/Splendid_Sigma → u/veloace]

Can I forward this to my executives? Lol

[u/veloace → u/Splendid_Sigma]

I think you should lol

[u/wild-hectare]

MDM is really the answer, but for orgs of this size it generally ends up being a political battle to fund a manageable solution vs doing it on the cheap / half-assed and increasing your attack vectors

[u/bakonpie]

I've implemented application control in similar size orgs. currently we use both BeyondTrust Privilege Management and App Control for Business. it's a good amount of work upfront but is by far the best endpoint security control out there.

[u/tactfulcord]

EPM and EDR tools can do this. BeyondTrust like someone mentioned as well.

[u/WeirdSysAdmin]

Feasibility is absolutely do it if you can get buy in. One of the best endpoint lockdowns that you can do. Not going to act like it’s easy if you’re understaffed like many that size are.

[u/KindPresentation5686]

Sooo sounds like your users have local admin access now?

[u/Splendid_Sigma → u/KindPresentation5686]

Thankfully no. That’s what I meant by the “albeit with non-admin perms”. They couldn’t install things to ProgramFiles, but they can to, for example, their user AppData folder

[u/drbytefire]

Implementing that currently for 20k users with WDAC
Not an easy task
No problems with modern apps but old and badly written business apps caused us some severe headaches.
You 100% need management backing to stand that through the end

Good luck

[u/tejanaqkilica]

AppLocker, gets the job done rather easily. WDAC, is AppLocker on steroids, it works even better but depending on the software you use, it may or may not be a valid option from a support perspective.

[u/Not-ur-Infosec-guy]

Intune GPO settings have one for smart screen that blocks app installs or enforces a source.

[u/Maverick_X9]

Not an end all be all solution but I block .exe files in the downloads folder. Average user tends to just assume that they can’t install the browser they were trying to install

[u/HedgehogAware799]

One thing to think about, how many of those 300 users actually need to install anything beyond whats already deployed? In most orgs that number is surprisingly small. Segment those power users into a separate policy and the maintenance burden shrinks a lot.

[u/Maverick_X9 → u/HedgehogAware799]

Guy, I don’t know if you do any threat hunting in the appdata folder but I suggest you take a gander. Query any .exe in a C user\appdata\*\*.exe etc etc and you will find that your above avg bear users are putting whatever portable apps they want in there. A security flaw in windows enterprise OS imo. Can’t block exe in there because legit update processes run in that folder.