I analyzed all Microsoft Defender for Endpoint threat intelligence reports published in 2025 to measure the real-world effectiveness of Windows application allowlisting. The results are now available in the yearly report shared by AppControl.AI. Enjoy the reading. #wdac
lnkd.in/eAsjaqxi

Elastic finds RONINGLOADER: trojanized NSIS installers, signed driver ollama.sys, PPL (ClipUp) abuse to tamper with Defender, custom WDAC blocking 360/Huorong, and thread-pool injection; linked to DragonBreath. #RONINGLOADER #PPL #WDAC https://bit.ly/47TE0Pa

WDAC Managed Installers: The Game-Changer for Application Control How one feature transforms WDAC from impossible to practicalIf you've ever tried to deploy Windows Defender Application Control (WDAC) in a real enterprise environment, you've probably hit the same wa...

Read how you can make your WDAC deployment a lot easier by using a (or multiple) Managed Installers #WDAC #AppControl www.appcontrol.ai/post/wdac-ma...

New blog post: Easily getting started with Intune Management Extension as managed installer
petervanderwoude.nl/post/easily-...
#MSIntune #Intune #EMS #MDM #Windows10 #Windows11 #IME #AppControl #WDAC

Autopilot Device Preparation Application Reporting Track Autopilot device-prep progress, diagnose failures, and surface clean reports to speed Windows deployments and reduce help-desk tickets.

@Mister_MDM addressed an issue he discussed with the #ITCommunity at #WPNinjaS25: how the Managed Installer (#WDAC) policy in #Intune can break #Autopilot Device Prep reporting, even when enrollment looks fine.

Here's to Rudy, for turning issues into valuable blogs ➡️ https://bit.ly/4q7QgUT

Mastering App Control for Business | Part 7: Maintaining your policies with Azure DevOps (or PowerShell) - ctrlshiftenter.cloud Hello everyone, in this last post in this series, I will describe how you can maintain your App…

🚀 New: App Control for Business — Part 7. Automate ACfB policy deployment: maintain, sign, and deploy to Intune via Azure DevOps pipelines or with PowerShell 7. Read more about this on my blog: www.ctrlshiftenter.cloud/bn0o
#AppControl #WDAC #Intune #PowerShell #DevOps #Security #Microsoft

Mastering App Control for Business | Part 6: Sign, apply and remove signed policies - ctrlshiftenter.cloud HI folks, in this post, I continue my blog series about Application Control for Business and take a…

🚀 New Blog Post – App Control for Business | Part 6
Learn how to sign, apply, and remove signed policies to protect against tampering.
Now on my blog 👇
👉 www.ctrlshiftenter.cloud/oat7 #WDAC #AppControl #EndpointSecurity #Cybersecurity #Microsoft #Intune #prevention

Mastering App Control for Business | Part 5: Create a base policy for fully managed devices - ctrlshiftenter.cloud Hi folks, in this blog post, I will continue my series on Application Control for Business and explain…

🚀 New Blog Post – App Control for Business | Part 5
How to create a custom base policy for fully managed devices — with PowerShell or the App Control Wizard.
Includes real examples with Notepad++
👉 www.ctrlshiftenter.cloud/4qz1
#WDAC #AppControl #Security #Intune

anyone else seeing "weird" behavior with #Intune Managed Installer? At first install of an application the files aren't tagged as being installed via Intune Managed Installer, if we uninstall the application and install it a second time they are tagged. #WDAC @intunesuppteam.bsky.social

Bypassing Windows Defender Application Control with Loki C2 Microsoft offers a bug bounty for qualifying bypasses into Windows Defender Application Control. Learn how IBM's X-Force team found a bypass using Loki C2.

IBM X-Force Highlights WDAC Bypass via Loki C2

IBM's X-Force team details methods to bypass Windows Defender Application Control using Loki C2, emphasizing the need for stringent security configurations and regular system audits. ​

Link: buff.ly/q1YS4uK

#CyberSecurity #WDAC #LokiC2 #IBMXForce

Mastering App Control for Business | Part 4: How to create a "starter base policy" for lightly managed devices - ctrlshiftenter.cloud In the last three blog posts about App Control for Business, I talked a lot of theory and…

🚀 New blog post: Mastering App Control for Business – Part 4 🔐
Learn how to create a “starter base policy” for lightly managed Windows devices.

www.ctrlshiftenter.cloud/qu8h

#WDAC #AppControl #Intune #CyberSecurity #ZeroTrust #Windows #MSIntune #Microsoft #EndpointManagement #Endpoint #Security

Mastering App Control for Business | Part 3: Application ID Tagging Policies & managed Installer - ctrlshiftenter.cloud Hello everyone. In my last blog post Mastering App Control for Business | Part 2: Policy Templates &…

🚀 New Blog Post: Mastering App Control for Business | Part 3 – App Tagging & Managed Installer
How to combine tagging policies with Windows Firewall & explore the pros/cons of Managed Installer.

🔗 www.ctrlshiftenter.cloud/gmva
#WDAC #AppControl #Intune #Securtiy #Microsoft

New Exploit for Bypassing Windows Defender Application Control Leverages JavaScript C2 The novel Loki C2 framework developed entirely in JavaScrip allowed the bypass of WDAC policies and performing post-exploitation activities undetected.

A new exploit that bypasses Windows Defender Application Control and leverages an advanced Command and Control (C2) method called Loki has been found.

#Electron #JavaScript #WDAC #C2Loki

Mastering App Control for Business | Part 2: Policy Templates & Rule Options - ctrlshiftenter.cloud In my last blog post Mastering App Control for Business | Part 1: Introduction & Key Concept I…

🚀 New Blog Post: Mastering App Control for Business | Part 2 🔐
Diving into policy templates, rule options & security settings in App Control for Business (ACfB)! 💡
📖 Read more: www.ctrlshiftenter.cloud/vmbo
#CyberSecurity #AppControl #WDAC #ITSecurity #ZeroTrust #EndpointSecurity #Intune

This can then be used to #block or #allow #software in #Microsoft #Defender - providing additional security ontop of App Control for business ( #WDAC )
I will have a blog post coming on App Control for Business, so keep your eyes peeled!

My issue with Intune EPM is that it can sort of deviate from the "everything must be pushed directly from intune" which means it leads further away from #WDAC

Mastering App Control for Business | Part 1: Introduction & Key Concept - ctrlshiftenter.cloud Off-Topic: This is my first blog post in English. Writing in a different language and even more so…

🚀 New Blog Post: Mastering App Control for Business | Part 1 🔐
Trusting all apps is risky! Attackers exploit detection gaps—traditional security is reactive, not proactive.

🔗 Read more: www.ctrlshiftenter.cloud/zhmp
#CyberSecurity #WDAC #ZeroTrust #AppControl4Business #Enterprise #M365 #Intune

Bloquez les logiciels non autorisés avec WDAC sur Windows Apprenez à configurer la fonctionnalité Windows Defender Application Control de Windows et Windows Server en suivant cette vidéo ! Cette fonctionnalité gratuite permet de renforcer la sécurité des machines grâce au filtrage applicatif basé sur des règles et sur la réputation. Démo et explications en français. 🌟 Rejoignez notre chaine pour nous soutenir et bénéficier d'avantages exclusifs : - https://www.youtube.com/channel/UCIJTq0nGrgkGMy1xJL_YppQ/join 📘 Découvrez mon livre sur Windows Server 2025 - https://amzn.to/3PBtqUo ⭐ Sommaire 00:00 Introduction 00:59 Qu'est-ce que Windows Defender Application Control ? 05:55 Créer une politique Windows Defender Application Control (WDAC) 10:40 WDAC - Déployer une politique par GPO 12:30 WDAC - Tester la politique en mode Audit 15:19 WDAC - Éditer une stratégie à partir des journaux Windows 17:57 WDAC - Fusionner deux politiques 20:05 WDAC - Bloquer les applications sur Windows 21:55 Conclusion ---- Pense à t'abonner pour ne rien manquer : ⭐ https://www.youtube.com/c/It-connectFr/?sub_confirmation=1 ----- 📢🙍♂️ Auteur :...

🛡️ 𝗕𝗹𝗼𝗾𝘂𝗲𝘇 𝗹𝗲𝘀 𝗹𝗼𝗴𝗶𝗰𝗶𝗲𝗹𝘀 𝗻𝗼𝗻 𝗮𝘂𝘁𝗼𝗿𝗶𝘀𝗲́𝘀

Windows Defender Application Control est un puissant outil intégré à Windows et Windows Server permettant de contrôler les applications autorisées à s'exécuter sur vos machines💡

📺 www.youtube.com/watch?v=pEKg...

#Windows #WDAC #Sécurité #Microsoft #SysAdmin

I still think it's "weird" that Microsoft is making it this difficult for IT to manage their enterprise environment: you can block the Store app via policy, but the only option I've found to block the Store website is via AppLocker for Business #WDAC

In just a day WP Ninja Connect will take place.
The afternoon is fully packed with topics like #epm #automation and #tokens #windows365 #devicequery #compromisedaccounts #devicemanagement #WDAC

Checkout the full lineup at https://buff.ly/3Opd14M

WP Connect Speaker announcement:

We have a new speaker to announce that flew in just a short time ago. Thank you @NielsKok
He will talk about #WDAC and how to use it in Intune.
More information about the event check: https://buff.ly/3Opd14M

#WPNinjasNL #WPNinjaNLConnect #WPNinjaConnect

Last session of the @MemSummit with @PerLarsen1975 talking about application control in Windows. #Applocker #WDAC #MEMSummit

Created a #WDAC policy with #MEMCM, but because all workloads are comanagement enabled, it doesn't actually send WDAC policy down to the client.
Where can I get a WDAC base policy with required rules for co-managed devices? #Intune #MEM