Most PowerShell scripts running in enterprise environments today are unsigned. People think code-signing is hard. It really isn't. This small blogpost is a small hack you can apply to make it even easier! Disclaimer: This blogpost assumes you have a code-signing certificate already. This is most likely an internal one from a PKI environment. We will do a follow-up post explaining how this can also work with alternative code-signing solutions out there. You have to author your

The video above is an unscripted conversation with the infrastructure lead and engineer, recorded after the project crossed 90% enforcement. A lot of application allowlisting projects don’t realize their full potential. The organization starts with good intentions, hits something that causes business impact, loses the trust of the business, and quietly walks it back. Sometimes they postpone the rollout, sometimes they just drop it entirely. This company didn't do that. They'r

Microsoft's Recommended Block Rules and the LOLBin Problem in WDAC Windows Defender Application Control (WDAC) is one of the stronger application control technologies available on Windows. When properly configured, it significantly narrows the attack surface available to an adversary who has landed on a system. But "properly configured" is doing a lot of work in that sentence — and understanding why requires looking at a trust assumption that sits at the very core of how WDA

In Part 1 of this series, we explored a fundamental question: just because an application is reputable, does that mean it belongs in your organization? We introduced the Intelligent Security Graph (ISG) and examined whether enabling it is the right call for your environment. In this second and final part, we shift focus to a technical challenge that the ISG introduces — one that is documented by Microsoft, but easy to misread and even easier to underestimate. A Warning Worth

A while ago I tweeted that "Signed and Reputable" didn't necessarily equate to "desirable" or "can't be used with malicious intent". A tweet is a tweet, and doesn't allow for a whole lot of room to clarify your point. So here's a blog article describing what I meant by it, or at least the first part of what I meant. Part 2 will be the real gotcha, stay tuned. What is the Intelligent Security Graph? Microsoft's Intelligent Security Graph (ISG) is a threat intelligence system t

One of the key findings in AppControl.AI 's application allowlisting effectiveness report was that just about every month Microsoft's Intel demonstrates that attack campaigns that strictly rely on script based code execution are a thing. This finding aligns with a well-established security industry trend: PowerShell- and script-based attacks remain one of the most prevalent and effective execution mechanisms used by adversaries on Windows platforms. By operating through trust

In Part 1 , we explained how Managed Installers work: AppLocker policy defines trusted processes, those processes tag files with NTFS Extended Attributes, and WDAC Rule Option 13 tells your policy to trust those tagged files. In Part 2 , we covered the backlog problem and how security catalogs solve it. Now it's time to look at how managed installers are actually configured in ConfigMgr and Intune environments. Both platforms have built-in support for setting up managed insta

AppControl.AI analyzed all Microsoft Defender for Endpoint threat intelligence reports published in 2025 to measure the real-world effectiveness of Windows application allowlisting. The results are now available in our yearly report.

Why existing applications create operational challenges and what to do about them In Part 1 , we covered how Managed Installers work and why they make AppControl for Business/WDAC deployment feasible. The core benefit is straightforward: instead of creating explicit allow rules for thousands of individual files, you trust your deployment process. Files written by managed installer processes receive NTFS Extended Attributes that WDAC recognizes as trusted. This works well for

How one feature transforms WDAC from impossible to practical If you've ever tried to deploy Windows Defender Application Control (WDAC) in a real enterprise environment, you've probably hit the same wall everyone else does: the sheer impossibility of managing application allow rules at scale. You start with good intentions, catalog a few applications, and then reality hits. Before you know it, you're drowning in a sea of file hashes, certificate rules, and exceptions that see

When Windows Defender Application Control (WDAC) is deployed in your environment, you might notice something peculiar happening with your...

==== 14th of August 2026 ==== Centralized unmatched files management The AppControl.ai portal already offered a view of unmatched files on a device by device level. We've now completed the circle and offer you a centralized view of all unmatched files in the environment under the WDAC results. The new unified view sorts the unmatched files into 6 different buckets with each bucket indicating a different trust-level. Files in Matched apps These are files we already see somewhe

What are Security Catalogs and why you should use them

The founders of AppControl.AI are strong believers in the need for an application allow listing solution to keep Windows security...