Invoke WDACSimulation

Invoke-WDACSimulation available parameters

Syntax

Invoke-WDACSimulation
  [-XmlFilePath] <FileInfo>
  [[-FolderPath] <DirectoryInfo[]>]
  [[-FilePath] <FileInfo[]>]
  [-BooleanOutput]
  [-CSVOutput]
  [-Log]
  [-NoCatalogScanning]
  [[-CatRootPath] <DirectoryInfo[]>]
  [[-ThreadsCount] <UInt32>]
  [<CommonParameters>]

Description

This cmdlet allows you to simulate an App Control for Business policy deployment. Simply select folders or files and a policy XML file, it will show you whether the selected files would be allowed or blocked by your App Control policy if it was actually deployed on a system and those files were run.

Supported Levels and SpecificFileNameLevel Options

• The App Control Simulation engine supports the following levels:

  • WHQLFilePublisher
  • WHQLPublisher
  • WHQL
  • FilePublisher
  • Publisher
  • SignedVersion
  • PCA Certificate
  • Root Certificate
  • Leaf Certificate
  • Hash
  • FilePath

• The engine supports all of the SpecificFileNameLevel options when validating the FilePublisher level.

  • FileDescription
  • InternalName
  • OriginalFileName
  • PackageFamilyName
  • ProductName
  • Filepath

• The Simulation engine doesn't support the following level yet (they will be added in a future update):

  • FileName

Accuracy

• The engine can determine with 100% accuracy whether a file is authorized by a given policy or not as long as the file was scanned based on one of the supported levels mentioned above.

Some Use Cases

• Have an App Control policy and you want to test whether all of the files of a program will be allowed by the policy without running the program first? Use this App Control simulation to find out.

• Employ this simulation method to discover files that are not explicitly specified in the App Control policy but are still authorized to run by it.

• Identify files that have hash mismatch and will not be permitted by App Control engine using signature. These files are typically found in questionable software because they are tampered with.

• And many more.

Parameters

-XmlFilePath

Path to a xml file. Supports argument tab completion, select the parameter then press TAB to open the file picker GUI that only shows xml files.

Type:	FileInfo
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-FolderPath

Path to folders. Supports argument tab completion, select the parameter then press TAB to open the Folder picker GUI.

Type:	DirectoryInfo[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-FilePath

Provide path to files that you want App Control simulation to run against

Type:	FileInfo[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-BooleanOutput

Can be used with any parameter to return a boolean value instead of displaying the object output. If any of the selected files or any of the files in the selected folders are not authorized by the selected XML file, the result is $false. Otherwise, the result is $true.

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-CSVOutput

Upon completion of the simulation, you will obtain a CSV file containing the output of the simulation with exhaustive details of each file that would be blocked/allowed by the selected policy, and which rule or signer in the XML policy is responsible for the decision.

It is saved in the WDACConfig folder in C:\Program Files\WDACConfig

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Log

Use this switch to start a transcript of the App Control simulation and log everything displayed on the screen.

The log file is saved in the WDACConfig folder in C:\Program Files\WDACConfig

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-CatRootPath

Provide path(s) to directories where security catalog .cat files are located. If not provided, the default path is C:\Windows\System32\CatRoot. Supports argument tab completion, select the parameter then press TAB to open the Folder picker GUI.

Type:	DirectoryInfo[]
Aliases:	Cat
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-NoCatalogScanning

Bypass the scanning of the security catalogs on the system. It can make the scan results less accurate.

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ThreadsCount

The number of the concurrent/parallel tasks to use when performing App Control Simulation.

• Max is the number of your system's CPU cores.
• Min is 1.
• If you enter a number higher than your system's CPU cores, it will be set to your system's CPU cores count.

Type:	UInt32
Aliases:	CPU
Position:	Named
Default value:	2
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False