Whitelisting SCCM deployed applications

Reply
L2 Linker

Whitelisting SCCM deployed applications

We use SCCM to deploy most of our corporate applications. Many of these applications are home grown apps that are prone to triggering a false positive malware detection. We are working on digitally signing these application but in the mean time we are looking for ways to basically honor SCCM deployments as legit.

 

Would whitelisting the ccmexec.exe process achieve this objective? While this is the process that copies the files down from SCCM and launches most of the apps....there are times where it extracts the binaries from a compressed file, drops them in a temp folder and then launches the install.

 

I am going to do some testing, but wanted to poll the community to see if anyone else has some experience with this situation. Thanks in advance!

Highlighted
L1 Bithead

Re: Whitelisting SCCM deployed applications

I suspect whitelisting ccmexec.exe won't achieve the goal you have in mind. That will allow that particular application to run, but depending on your policies (execution restrictions), Traps may block the execution from Temp folders.

 

Ultimately, you are looking to whitelist the corporate apps that will be running, not ccmexed.exe, right?

 

Here are a few of suggestions:

  1. If these apps don't change often, whitelist their hashes by adding an Admin Override Policy (in the Hash Control table) for each application. That will allow them to run anywhere in the environment.
  2. If it is possible to control which folder these apps are executed in when they are downloaded, I would choose a specific folder (other than C:\Temp and other "standard" temp directories) and whitelist the folder as well (in Execution Restrictions).
  3. If these apps change often, run them on a Traps-protected machine (anywhere in your environment) before distributing them. That way, you can ensure that if they are blocked by Traps for whatever reason (and are presumably quarantined), your admins can restore the apps and thereby whitelisting them across the environment.

Keep in mind that the Execution Restrictions are always checked, regardless of which other malware prevention methods are invoked. So be sure to verify these restrictions match what you're looking to set up. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!