PortableApps - Block all

[tlmarques]

Hello, I would like to know if anyone has ever blocked portable applications...

We would like to block PortableApps (PortableApps.com)... without blocking them one by one, as there are many. Has anyone ever blocked them using a wildcard in the process name? I know it's not entirely secure to block solely based on the process name, but it would be helpful...

Does anyone have any ideas or suggestions?

[jmazzeo · Accepted solution]

Hi @tlmarques, thanks for reaching us using the Live Community.

I did some reasearch, and all the executable files are signed by "Rare Ideas, LLC", it means that you can create a custom BIOC rule to clock this signer.

I have created this test, and it worked:

• Created a new custom BIOC rule in Detection Rules - BIOC

• With right click I have assigned the rule to a restrictions profile.

• I have enabled the "Custom Prevention Rules" action in the assigned Restrictions Profile, and the rule appears there.

• The downloaded Notepad++ is blocked in execution. This also can work in the extraction point, the exe uses the same signature name.

If this works for you, mark this post as the solution. Thanks!