Windows Store Apps definition

Forum|Forum|1 year ago
February 14, 2025
5 replies
381 views

I had been trying to define Windows Store Apps as my Windows 11 devices keep getting these executables targeted under Default - Any Application which is generally Blocked under my definition.

c:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.sechealthui_8wekyb3d8bbwe.appx

c:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.ui.xaml.appx

c:\windows\system32\securityhealth\10.0.27703.1006-0\\microsoft.vclibs.appx

I tried to use “Application Name” of “Microsoft.SecHealthUI” and “Application Publisher” of “Microsoft Corporation” (based on the analytics logs) but is not getting triggered. Under my definition, I used the filter “Windows Store Pkg Name” to point to the “Application Name” from the log and the “Windows Store Publisher” pointing to the Application Publisher, also based on the log.

Amy I doing something wrong with my definition?

Best answer by Neil

Interesting. It’s difficult to say what is happening without looking directly at the logs, have you opened a case with BT support yet by any chance? A PGCapture would hopefully provide a bit more insight into our options here.

One thing that might help isolate which criteria isn’t matching would be to remove the “Windows Store Pkg Name” criteria as a test. This will confirm whether we are at least matching properly against the Publisher.

N

Neil

BeyondTrust Employee

Hey @Jasper, first thing I’d change on your end is correct the Exact Match on your publisher definition -- there looks to be a typo there: “Micosoft” vs. “Microsoft”.

If that doesn’t help, could you clarify if the goal here is to try and block this from running (or are we building an elevation rule?)

J

JasperAuthor

Veteran

Thanks for that Neil. I updated it with the correct spelling when I realized that. Unfortunately, it still got blocked. My aim is to allow it to run as it cannot find the definition I had put in place above the catch all Default - Any Application (this is generally blocked). I had added the definition on the Passive - Allowed Functions and Apps and is supposed to be allowed but gets triggered only under the catch all. Same thing happens to the other 2 appx

N

NeilAnswer

BeyondTrust Employee

Interesting. It’s difficult to say what is happening without looking directly at the logs, have you opened a case with BT support yet by any chance? A PGCapture would hopefully provide a bit more insight into our options here.

One thing that might help isolate which criteria isn’t matching would be to remove the “Windows Store Pkg Name” criteria as a test. This will confirm whether we are at least matching properly against the Publisher.

J

JasperAuthor

Veteran

I did remove the Windows Store Pkg Name and it got triggered under the Application Publisher. Just wondering why it does not like the Windows Store Pkg Name as it is automatically populated when you add that in based on the analytics logs. Right now, it is working as expected

C

Courtney N

BeyondTrust Employee

Please review KB0020374 to ensure the app is the supported type. There is also a quick disclaimer about compatibility in KB0019813 with a link to MS for additional details.

Badge Earners

Sign up

Login to the community