Skip to content

Commit 27c3758

Browse files
HotCakeXHotCakeX
authored
AppControl Manager v2.0.25.0 (#755)
Introduced a tailor-made policy to block Remote Management and Monitoring software, mitigating the recent surge in RMM-based attacks. This policy prevents execution of known RMM tools and thwarts unauthorized remote access. Administrators may enable, disable or deploy it in Audit mode to monitor activity within the network. It covers an extensive catalog of executables by filename and directory path—regardless of drive letter—and can be extended by submitting additional entries via GitHub Issues. Updated the View File Certificates feature to function without Administrator privileges. Added a modern Windows 11–style "AppControl Manager" entry to the File Explorer right-click (or tap-and-hold) interface, granting instant access to certificate inspection, hash calculation, and direct launching of XML/CIP files in the Policy Editor. Future enhancements will include folder-wide block actions, all implemented with high-performance code to eliminate any delay in the context menu. Enhanced the View File Certificates page with an informative banner that displays essential metadata for the file under inspection. Shrunk the MSIXBundle footprint by leveraging an architecture-aware build pipeline, resulting in a leaner app package.
1 parent 2dfa5a0 commit 27c3758

49 files changed

Lines changed: 3978 additions & 14363 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/Build AppControl Manager MSIX Package.yml‎

Lines changed: 415 additions & 269 deletions
Large diffs are not rendered by default.

‎AppControl Manager/App.xaml.cs‎

Lines changed: 91 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
using Microsoft.Extensions.Hosting;
3232
using Microsoft.UI.Xaml;
3333
using Microsoft.UI.Xaml.Controls;
34+
using Microsoft.Windows.ApplicationModel.WindowsAppRuntime;
3435
using Microsoft.Windows.AppLifecycle;
3536
using Microsoft.Windows.Globalization;
3637
using Windows.ApplicationModel;
@@ -203,7 +204,7 @@ internal App()
203204
Logger.Write(string.Format(GlobalVars.Rizz.GetString("AppStartupMessage"), Environment.Version));
204205

205206
// https://github.com/microsoft/WindowsAppSDK/blob/main/specs/VersionInfo/VersionInfo.md
206-
// Logger.Write($"Built with Windows App SDK: {ReleaseInfo.AsString} - Runtime Info: {RuntimeInfo.AsString}");
207+
Logger.Write($"Built with Windows App SDK: {ReleaseInfo.AsString} - Runtime Info: {RuntimeInfo.AsString}");
207208

208209
// Give beautiful outline to the UI elements when using the tab key and keyboard for navigation
209210
// https://learn.microsoft.com/windows/apps/design/style/reveal-focus
@@ -253,7 +254,7 @@ private async void TaskScheduler_UnobservedTaskException(object? sender, Unobser
253254
/// Invoked when the application is launched.
254255
/// </summary>
255256
/// <param name="args">Details about the launch request and process.</param>
256-
protected override void OnLaunched(Microsoft.UI.Xaml.LaunchActivatedEventArgs args)
257+
protected override async void OnLaunched(Microsoft.UI.Xaml.LaunchActivatedEventArgs args)
257258
{
258259
// Register the Jump List tasks
259260
/*
@@ -328,6 +329,44 @@ protected override void OnLaunched(Microsoft.UI.Xaml.LaunchActivatedEventArgs ar
328329
Logger.Write(GlobalVars.Rizz.GetString("FileActivationNoArgumentsMessage"));
329330
}
330331
}
332+
else
333+
{
334+
Logger.Write($"ExtendedActivationKind: {activatedEventArgs.Kind}");
335+
336+
/*
337+
Windows.ApplicationModel.Activation.LaunchActivatedEventArgs launchArgs = (Windows.ApplicationModel.Activation.LaunchActivatedEventArgs)activatedEventArgs.Data;
338+
string passed = launchArgs.Arguments;
339+
340+
Logger.Write($"Arguments: {passed}");
341+
*/
342+
343+
string[] possibleArgs = Environment.GetCommandLineArgs();
344+
345+
// Look for our two keys
346+
string? actionArg = possibleArgs.FirstOrDefault(a => a.StartsWith("--action=", StringComparison.OrdinalIgnoreCase));
347+
string? fileArg = possibleArgs.FirstOrDefault(a => a.StartsWith("--file=", StringComparison.OrdinalIgnoreCase));
348+
349+
if (actionArg is not null && fileArg is not null)
350+
{
351+
// Extract values past the '=' and trim any quotes
352+
string action = actionArg["--action=".Length..];
353+
354+
string filePath = fileArg["--file=".Length..].Trim('"');
355+
356+
Logger.Write($"Parsed Action: {action}");
357+
Logger.Write($"Parsed File: {filePath}");
358+
359+
// Save file path and action for later navigation
360+
if (!string.IsNullOrWhiteSpace(filePath) && !string.IsNullOrWhiteSpace(action))
361+
{
362+
Settings.LaunchActivationFilePath = filePath;
363+
Settings.LaunchActivationAction = action;
364+
365+
// If the selected file is not accessible with the privileges the app is currently running with, prompt for elevation
366+
requireAdminPrivilege = !FileAccessCheck.IsFileAccessibleForWrite(filePath);
367+
}
368+
}
369+
}
331370
}
332371
catch (Exception ex)
333372
{
@@ -425,7 +464,7 @@ protected override void OnLaunched(Microsoft.UI.Xaml.LaunchActivatedEventArgs ar
425464

426465
try
427466
{
428-
_ = PolicyEditorViewModel.OpenInPolicyEditor(Settings.FileActivatedLaunchArg);
467+
await PolicyEditorViewModel.OpenInPolicyEditor(Settings.FileActivatedLaunchArg);
429468
}
430469
catch (Exception ex)
431470
{
@@ -440,6 +479,55 @@ protected override void OnLaunched(Microsoft.UI.Xaml.LaunchActivatedEventArgs ar
440479
Settings.FileActivatedLaunchArg = string.Empty;
441480
}
442481
}
482+
// If there is/was activation through context menu
483+
else if (!string.IsNullOrWhiteSpace(Settings.LaunchActivationAction))
484+
{
485+
try
486+
{
487+
if (string.Equals(Settings.LaunchActivationAction, "PolicyEditor", StringComparison.OrdinalIgnoreCase))
488+
{
489+
ViewModelForMainWindow.NavViewSelectedItem = ViewModelForMainWindow.allNavigationItems
490+
.First(item => string.Equals(item.Tag.ToString(), "PolicyEditor", StringComparison.OrdinalIgnoreCase));
491+
492+
await PolicyEditorViewModel.OpenInPolicyEditor(Settings.LaunchActivationFilePath);
493+
}
494+
else if (string.Equals(Settings.LaunchActivationAction, "FileSignature", StringComparison.OrdinalIgnoreCase))
495+
{
496+
ViewFileCertificatesVM vm = AppHost.Services.GetRequiredService<ViewFileCertificatesVM>();
497+
498+
ViewModelForMainWindow.NavViewSelectedItem = ViewModelForMainWindow.allNavigationItems
499+
.First(item => string.Equals(item.Tag.ToString(), "ViewFileCertificates", StringComparison.OrdinalIgnoreCase));
500+
501+
await vm.OpenInViewFileCertificatesVM(Settings.LaunchActivationFilePath);
502+
}
503+
else if (string.Equals(Settings.LaunchActivationAction, "FileHashes", StringComparison.OrdinalIgnoreCase))
504+
{
505+
GetCIHashesVM vm = AppHost.Services.GetRequiredService<GetCIHashesVM>();
506+
507+
ViewModelForMainWindow.NavViewSelectedItem = ViewModelForMainWindow.allNavigationItems
508+
.First(item => string.Equals(item.Tag.ToString(), "GetCodeIntegrityHashes", StringComparison.OrdinalIgnoreCase));
509+
510+
await vm.OpenInGetCIHashes(Settings.LaunchActivationFilePath);
511+
}
512+
else
513+
{
514+
InitialNav();
515+
}
516+
}
517+
catch (Exception ex)
518+
{
519+
Logger.Write(ErrorWriter.FormatException(ex));
520+
521+
// Continue doing the normal navigation if there was a problem
522+
InitialNav();
523+
}
524+
finally
525+
{
526+
// Clear the launch activation args after they've been used
527+
Settings.LaunchActivationFilePath = string.Empty;
528+
Settings.LaunchActivationAction = string.Empty;
529+
}
530+
}
443531
else
444532
{
445533
InitialNav();

‎AppControl Manager/AppControl Manager.csproj‎

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,6 @@
6262
<AppxPackageSigningEnabled>False</AppxPackageSigningEnabled>
6363
<!-- This specifies what hashing algorithm must be used for the certificate that will sign the MSIX package -->
6464
<AppxPackageSigningTimestampDigestAlgorithm>SHA512</AppxPackageSigningTimestampDigestAlgorithm>
65-
<!-- <AppxPackageSigningTimestampDigestAlgorithm>SHA256</AppxPackageSigningTimestampDigestAlgorithm> -->
6665
<AppxAutoIncrementPackageRevision>False</AppxAutoIncrementPackageRevision>
6766

6867
<!-- Defining custom directory in the root directory to be created if it doesn't exist. MSIX package after packing will be stored there -->
@@ -78,7 +77,7 @@
7877
<!-- https://learn.microsoft.com/dotnet/core/deploying/native-aot/optimizing -->
7978

8079
<ErrorReport>send</ErrorReport>
81-
<FileVersion>2.0.24.0</FileVersion>
80+
<FileVersion>2.0.25.0</FileVersion>
8281
<AssemblyVersion>$(FileVersion)</AssemblyVersion>
8382
<NeutralLanguage>en-US</NeutralLanguage>
8483
<PackageLicenseFile>LICENSE</PackageLicenseFile>
@@ -191,7 +190,7 @@
191190
<NuGetAuditMode>all</NuGetAuditMode>
192191
<NuGetAuditLevel>low</NuGetAuditLevel>
193192

194-
<GenerateDocumentationFile>True</GenerateDocumentationFile>
193+
<GenerateDocumentationFile>false</GenerateDocumentationFile>
195194

196195
<DocumentationFile>AppControlManagerAPIDocumentation.xml</DocumentationFile>
197196

@@ -331,8 +330,6 @@
331330
</PropertyGroup>
332331

333332
<ItemGroup>
334-
<None Remove="CppInterop\ScheduledTaskManager-ARM64.exe" />
335-
<None Remove="CppInterop\ScheduledTaskManager-x64.exe" />
336333
<None Remove="Pages\AllowNewAppsDataGrid.xaml" />
337334
<None Remove="Pages\AllowNewAppsEventLogsDataGrid.xaml" />
338335
<None Remove="Pages\AllowNewAppsLocalFilesDataGrid.xaml" />
@@ -364,13 +361,12 @@
364361
<None Remove="Resources\Allow All Policy.xml" />
365362
<None Remove="Resources\Allow Microsoft Template.xml" />
366363
<None Remove="Resources\AppControlManagerSupplementalPolicy.xml" />
364+
<None Remove="Resources\Blocking RMMs - Remote Monitor and Management.xml" />
367365
<None Remove="Resources\Default Windows Template.xml" />
368366
<None Remove="Resources\EmptyPolicy.xml" />
369367
<None Remove="Resources\ISGBasedSupplementalPolicy.xml" />
370368
<None Remove="Resources\StrictKernelMode.xml" />
371369
<None Remove="Resources\StrictKernelMode_NoFlightRoots.xml" />
372-
<None Remove="RustInterop\DeviceGuardWMIRetriever-ARM64.exe" />
373-
<None Remove="RustInterop\DeviceGuardWMIRetriever-X64.exe" />
374370
</ItemGroup>
375371
<ItemGroup>
376372
<Content Include="Assets\SplashScreen.scale-200.png" />
@@ -379,16 +375,10 @@
379375
<Content Include="Assets\Square44x44Logo.scale-200.png" />
380376
<Content Include="Assets\Square44x44Logo.targetsize-24_altform-unplated.png" />
381377
<Content Include="Assets\Wide310x150Logo.scale-200.png" />
382-
<Content Include="CppInterop\ManageDefender-ARM64.exe">
378+
<Content Include="CppInterop\ManageDefender.exe">
383379
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
384380
</Content>
385-
<Content Include="CppInterop\ManageDefender-x64.exe">
386-
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
387-
</Content>
388-
<Content Include="CppInterop\ScheduledTaskManager-ARM64.exe">
389-
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
390-
</Content>
391-
<Content Include="CppInterop\ScheduledTaskManager-x64.exe">
381+
<Content Include="CppInterop\ScheduledTaskManager.exe">
392382
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
393383
</Content>
394384
<Content Include="Resources\Allow All Policy.xml">
@@ -400,6 +390,9 @@
400390
<Content Include="Resources\AppControlManagerSupplementalPolicy.xml">
401391
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
402392
</Content>
393+
<Content Include="Resources\Blocking RMMs - Remote Monitor and Management.xml">
394+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
395+
</Content>
403396
<Content Include="Resources\Default Windows Template.xml">
404397
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
405398
</Content>
@@ -415,10 +408,10 @@
415408
<Content Include="Resources\StrictKernelMode_NoFlightRoots.xml">
416409
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
417410
</Content>
418-
<Content Include="RustInterop\DeviceGuardWMIRetriever-ARM64.exe">
411+
<Content Include="RustInterop\DeviceGuardWMIRetriever.exe">
419412
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
420413
</Content>
421-
<Content Include="RustInterop\DeviceGuardWMIRetriever-X64.exe">
414+
<Content Include="Shell\Shell.dll">
422415
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
423416
</Content>
424417
</ItemGroup>
@@ -432,14 +425,6 @@
432425
<Content Remove="version.txt" />
433426
<None Remove="version.txt" />
434427

435-
<Compile Remove="DownloadURL.txt" />
436-
<Content Remove="DownloadURL.txt" />
437-
<None Remove="DownloadURL.txt" />
438-
439-
<Compile Remove="AppControlManagerAPIDocumentation.xml" />
440-
<Content Remove="AppControlManagerAPIDocumentation.xml" />
441-
<None Remove="AppControlManagerAPIDocumentation.xml" />
442-
443428
<Compile Remove="MSIXBundleDownloadURL.txt" />
444429
<Content Remove="MSIXBundleDownloadURL.txt" />
445430
<None Remove="MSIXBundleDownloadURL.txt" />

0 commit comments

Comments
 (0)