Whitelisting SCCM deployed applications

[thinson]

We use SCCM to deploy most of our corporate applications. Many of these applications are home grown apps that are prone to triggering a false positive malware detection. We are working on digitally signing these application but in the mean time we are looking for ways to basically honor SCCM deployments as legit.

Would whitelisting the ccmexec.exe process achieve this objective? While this is the process that copies the files down from SCCM and launches most of the apps....there are times where it extracts the binaries from a compressed file, drops them in a temp folder and then launches the install.

I am going to do some testing, but wanted to poll the community to see if anyone else has some experience with this situation. Thanks in advance!

[mmoshiri]

I suspect whitelisting ccmexec.exe won't achieve the goal you have in mind. That will allow that particular application to run, but depending on your policies (execution restrictions), Traps may block the execution from Temp folders.

Ultimately, you are looking to whitelist the corporate apps that will be running, not ccmexed.exe, right?

Here are a few of suggestions:

1. If these apps don't change often, whitelist their hashes by adding an Admin Override Policy (in the Hash Control table) for each application. That will allow them to run anywhere in the environment.
2. If it is possible to control which folder these apps are executed in when they are downloaded, I would choose a specific folder (other than C:\Temp and other "standard" temp directories) and whitelist the folder as well (in Execution Restrictions).
3. If these apps change often, run them on a Traps-protected machine (anywhere in your environment) before distributing them. That way, you can ensure that if they are blocked by Traps for whatever reason (and are presumably quarantined), your admins can restore the apps and thereby whitelisting them across the environment.

Keep in mind that the Execution Restrictions are always checked, regardless of which other malware prevention methods are invoked. So be sure to verify these restrictions match what you're looking to set up.