2

I know Windows 10 has a lockdown option, to forbid running unsigned code. But in my organization, I'd get shot if I tried to do that. So I'd like the next best thing: a remote alert whenever unsigned code is run. Does Windows have a way to do that?

I'd also really like either Windows itself, or Defender, to have an option to add custom malware definitions, so I can add definitions for crap (even though technically not malware) that people aren't supposed to be installing (regardless of whether it's signed). For this too, I'd get shot if I configured our systems to automatically block/delete the crap, but I'd at least like to get an alert. See my related question: Can I configure Windows Defender to reject competing AV programs?

  • 1
    This is an interesting question, and I applaud your creative thinking. However, it sounds like you’re trying to jump through hoops to impose some kind of control, where your organization hasn’t granted you permission to have such control. I really do think you need to solve the people problem first, and then work out the technical details of how you are going to enforce the policies you’ve agreed upon. – nbering Jul 13 '18 at 18:02
2

You can turn on 'audit' mode when unsigned code is run and that will generate Windows event logs which you can ingest into your SIEM and have that alert you. See here for in-depth guide. Why are you interested in unsigned files being loaded? If it's a malware prevention step then it might help but I think you'll receive so many false positives on a network where users are allowed to install their own programs it won't be worth it. There's also the issue that malware is frequently signed nowadays, see here and here.

For your second question about having Defender use custom malware sigs the answer is no, you can't write your own rules. What you could do is run ClamAV on all the endpoints and you can write your own custom rules for that, see this and this. Do you really need signatures though? Can't you push out a script to endpoints to return a list of installed programs and use that?

I think you've got bigger problems though, as an IT admin you should have the power to enforce that users aren't able to install whatever they want on your network. That also suggests have admin rights on boxes as well? I think code signing is the least of your worries and you should start implementing some basic IT security best practices before starting with more advanced ones. This can be a tough sell to management but if you Google around for the cost of malware compromises and network outages and sell it in terms of revenue it might help.

  • I made another comment above, but realized I skimmed past the last paragraph of this answer. Totally agreed. It’s tempting to jump to advanced solutions to work around organizational issues, but they’ll be ineffective without a foundation of the basics. – nbering Jul 13 '18 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.