Skip to content

Instantly share code, notes, and snippets.

@ion-storm

ion-storm/CustomASRRuleGenerator.ps1

Forked from mattifestation/CustomASRRuleGenerator.ps1
Created September 10, 2019 02:38
Show Gist options
  • Save ion-storm/1458ce089fa08c8d7858acb918d001e8 to your computer and use it in GitHub Desktop.
Save ion-storm/1458ce089fa08c8d7858acb918d001e8 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
CustomASRRuleGenerator.ps1
$ScrObjBlockRule = New-CIPolicyRule -DriverFilePath $Env:windir\System32\scrobj.dll -Level FileName -Deny -AppID $Env:windir\System32\regsvr32.exe
# Merge the block rule into the allow all template rule included in the OS
Merge-CIPolicy -OutputFilePath CustomASRPolicy.xml -PolicyPaths $Env:windir\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml -Rules $ScrObjBlockRule
# This must be run elevated. Convert the policy to binary form and copy it to where WDAC will consume it.
ConvertFrom-CIPolicy -XmlFilePath .\CustomASRPolicy.xml -BinaryFilePath $Env:windir\System32\CodeIntegrity\SIPolicy.p7b
# Now reboot and the policy will take effect.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment