Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Blocks in the c:\program files\windowsapps\ directory

App Control: Blocks in the c:\program files\windowsapps\ directory

Environment

  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Symptoms

Block events in the c:\program files\windowsapps\ directory.

Cause

  • Windows App Store files (appx packages) are currently not tracked as interesting files by App Control
  • Current mechanism to approve Windows updates doesn't consider Apps as part of the operating system.

Resolution

  1. Login to the App Control console
  2. Navigate to Rules > Software Rules > Rapid Configs tab
  3. Enable the "Windows App Store" Rapid Config
    • To modify the Rapid Config to only allow certain applications, click "View Details" next to the rule

Additional Notes

  • The Rapid Config approves on write. If a file in the directory existed prior to creating and enabling the rules, it would be expected for the file to be blocked. Another approval method such as locally approving the file will be necessary if this scenario occurs.
  • If the Windows App Store Rapid Config is already enabled with the blocks occurring, please open a Support case and provide a set of agent logs for further analysis of these blocks: App Control: How to Collect Historical Agent Logs Remotely for Troubleshooting

Related Content


Labels (1)
Attachments
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎05-19-2016
Views:
9100