Dr.Web Enterprise
Security Suite 12.0
Features of the Application
Control module
Functional analysis© Doctor Web
2003–2019

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module
Functional analysis
No one knows what processes are running on a controlled computer. It's entirely possible to use
special utilities to view the list of downloaded programs (if, of course, one doesn’t know thatmalicious programs track the launch of these utilities and stop working as soon as they detectthem). But while obtaining a list of running programs is fairly feasible, figuring out what a programor script does is no longer always possible.
With the Application Control module included in the Dr.Web Enterprise Security Suite
Control Center, you can create rules that prohibit the launch of certain categories of software.
This prevents suspicious programs from being able to run from the risk zone—anti-virus softwaredevelopers certainly know what features usually count as malicious when examining suchprograms!
Configure the application control system by using profiles—the profile settings will dictate whichapplications will be launched or blocked on stations (or for selected users).
To create a profile
1. Select Anti-virus Network in the Control Center's main menu.
2. In the newly appeared window, on the toolbar, click on Add network object → Create profile.

3. In the newly opened panel, enter the Profile name.

4. Click on Save.

5. The new profile will be created and placed in the Profiles group of the anti-virus network tree.
After you create a profile, you need to configure it (set the necessary restrictions and operatingrules) and assign it to anti-virus network stations and users.
Important! It is recommended that you configure profiles in the test mode. The test mode imitates
what the Application Control module does, fully logging the activity occurring on all the protected
stations in the statistics log, but applications are not actually blocked.
2

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

1. In the Control Center's main menu, select Anti-virus Network. Click on the profile name in
the hierarchical list of the anti-virus network (on the right side of the Control Center's window,
the profile properties panel will automatically open), or click on the profile icon in the anti-virus
network tree, or select a profile and then select Properties in the control menu (a window
showing the profile properties will open).

2. Select Enable profile to start using this profile. If you select Switch profile to global testmode, all the profile settings will not be applied to the stations, but activity will be recorded asif the settings were enabled.
3. In the Functional analysis criteria section, select the events that you want to track.
In this section, you can specify the features that are unwanted or desirable for the programs
launched on the protected computers. To specify advanced settings for each selected event
criteria type, click on (Edit) for the corresponding type of event. A window showing a list ofsettings will open.
Let's consider the advanced settings in more detail.
There are 6 criteria types of functional analysis:
 Application launch Module load and execution
3

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

 Launch of script interpreters
 Driver loading MSI package installation
 Executable file integrity
Each group has its own set of criteria; let's consider them in detail.
Application launch

The list of permissions is easy to understand, so let's proceed to the prohibitions. Most items
do not even need any commentary—it is obvious what kind of programs fall within them andwhether you need to launch them: Prevent the running of applications signed by certificates known in Doctor Web as certificates
for adware Prevent the running of applications signed by certificates known in Doctor Web as gray Prevent the running of applications signed by certificates known in Doctor Web as certificatesfor hacktools Prevent the running of applications signed by fake/malformed certificates Prevent the running of applications signed by certificates known in Doctor Web as certificatesfor malware
 Prevent the running of applications signed by revoked certificates Prevent the running of Sysinternals utilities
 Prevent the running of applications from NTFS (ADS) alternate threads

4Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

 Prevent the running of Windows/Microsoft Store applications (only for Windows 8 and later) Prevent the running of applications with a double/atypical extension
It’s well understood that Linux programs run under Windows are not used in most systems, so wecan also select Prevent running of bash shells and WSL applications (only for Windows 10and above).
It’s also not a bad idea to prohibit the launch of applications from removable media (Prevent therunning of applications from removable media) and over the network (Prevent the runningof applications from the network and shared resources). Flash cards are a well-known sourceof viruses.
Quite often, malware is used to run folders for temporary files. If you are not going to deploy newsoftware that can also use those folders—select the option Prevent the running of applications
from temporary folders.
Module load and execution

Control the loading and execution of all modules
Control the loading and execution of modules in host applications
The list of permissions is also straightforward; the prohibitions are similar to the previous section.

5

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

Launch of script interpreters

In this section, you can prohibit the types of scripts (and also registry modification) that are
definitely not used in your system and their launch from removable media or from temporary
directories.
Driver loading

6

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

In addition to the prohibitions described above in this section, there is a unique option—Preventthe loading of vulnerable driver versions of popular software. We think that its importanceis clear.
MSI package installation

Malicious packages are often used by malicious software. You can use the options in this section
to prevent the launch of installation packages.

7

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

Executable file integrity

This is probably the most simple and attractive option. An anti-virus must cure, so it’s logical for
it to have the right to modify objects. But the updating system can also modify objects. So, if you
are using a Microsoft updating system, you can prevent the modification of executable files for allother sources by ticking the boxes on the Prohibitions page.
Tick the boxes for the settings that you want to be applied, and don't forget—before enabling thenew operation mode on stations, it should be tested.
If you enable an event type but do not specify its advanced settings, launch control will be carriedout for all the objects according to this criteria in accordance with the allow or deny modes. If you
specify advanced settings but do not enable the event type itself, neither the advanced settings
nor the criteria will be executed.
To save the advanced settings, click on Save in the window containing the list of advanced settings.
4. To apply the settings specified in the General section, click on Save in the profile settings.
The second stage in configuring the application launch control system involves assigning a createdand configured profile to stations or anti-virus network users.
1. Select Anti-virus Network in the Control Center's main menu.
2. In the newly appeared window, from the hierarchical list, select the profile that you wantto assign.
3. On the toolbar, click on Export Data → Assign profile.

8

Dr.Web Enterprise Security Suite 12.0
Features of the Application Control module Functional analysis

4. In the newly appeared window, select the object to which the settings are to be distributed. Inthe case of the global deny to execute malicious code option, the most logical thing to do is toassign this restriction to all the stations in the anti-virus network.
In the Anti-virus Network tab, you can select groups of stations (the settings will be applied
to all the user accounts of all the stations included in the group data) or individual stations ingroups (the settings will be applied to all the user accounts of the selected stations):

5. Click on Save. All the selected objects will be added to the list to which the profile is being
applied. Furthermore, the objects will appear as nested items for the configured profile.
The problem solved.

© Doctor Web

2003–2019

3rd street Yamskogo polya 2-12А, Moscow, Russia, 125040
Tel.: +7 (495) 789–45–87
Fax: +7 (495) 789–45–97
https://www.drweb.com | hhttps://free.drweb.com | https://ru.av-desk.com | https://curenet.drweb.com
9