Application Block in OneView has two families of rules that determine how an application is blocked. Use a Basic rule to block a known, installed application everywhere it appears. Use an Advanced rule to target a specific file, folder, publisher certificate, or portable application. This article explains how each rule type matches files and helps you choose the right one. For setup steps, see Configure Application Block rule in OneView.
Rule family overview
| Basic rules | Advanced rules | |
|---|---|---|
| Rule types | Application, Vendor, Category | File Path, File Property, Hash, Certificate Property |
| How a match is made | The agent checks the application against ThreatDown's application library | The agent compares the running file's attributes with the values you enter |
| Blocks a renamed file or non-standard install folder | Yes | Depends on the rule type |
| Blocks portable applications | No | Yes |
| Effort to configure | Select from a list | Look up and enter values |
All rules are block rules, so there's no order of priority when several rules apply to the same policy.
Basic rules
Basic rules match an application by its signature, not by its file name or location. When a program runs, the ThreatDown agent checks it against an application library. The library holds a signature for each known variant of each product.
A single product can have many variants, each with its own signature. Variants differ by:
- Architecture, such as x86, x64, or ARM64.
- Installer type, such as executable (EXE) or Microsoft Installer (MSI).
- Installation scope, either per-machine or per-user.
- Distribution channel, either desktop installer or Microsoft Store.
- Major release line, such as Java 7 and Java 8.
The rule targets the product and all of its signatures, so the block still applies when:
- The application is installed in a non-standard folder.
- A user renames the executable.
- A different edition or version of the same product is installed.
Basic rules can't block portable applications. A portable application runs without being installed, so it has no installation signature to match. Use an Advanced rule instead, such as File Property, Hash, or Certificate Property.
Basic rule types
Application
An Application rule blocks a product by name across all known versions and variants. Use it when you know exactly which application to stop, such as a specific remote access tool or game client.
Vendor
A Vendor rule blocks all applications from the selected vendor, regardless of product, version, installation method, or location. Use it to block all software from a particular vendor. Vendor rules are broad, so first check that the vendor doesn't also publish software needed by end users.
Category
A Category rule blocks a group of applications with a similar purpose, such as file sharing or remote access. Use it to enforce a policy, such as blocking all peer-to-peer clients, without listing each product.
When saving a Category rule, ThreatDown automatically creates an allow rule for all Microsoft and ThreatDown applications. This protects system stability and the agent itself if a category includes them. Category is the only rule type that creates an allow rule.
Advanced rules
Advanced rules match a file based on the attributes entered in OneView. The ThreatDown agent checks these attributes directly when the file runs. Advanced rules don't depend on the application library, so they work for portable applications, in-house tools, and anything else the library doesn't recognize.
Advanced rules offer greater precision but require more effort, because an admin has to look up the values themselves. To find a file's properties, hashes, or certificate details, see Get file information for Application Block rules in OneView.
These behaviors apply to all Advanced rules:
- When a rule has more than one property, a file that matches any of them is blocked.
- A broad value such as Photoshop can match other applications that share it.
Advanced rule types
File Path
A File Path rule blocks files by folder, file name, or both. Use * as a wildcard. Example: C:\Users\*\Downloads\*.exe blocks executables from running in any user's Downloads folder.
File Path is the most flexible way to block by location, but it's also the easiest to get around. If a user moves or renames the file, the rule may no longer match. To prevent this, pair it with a File Property or Hash rule.
File Property
A File Property rule blocks files by the metadata built into the executable.
| Property | What it usually contains | Use it to |
|---|---|---|
| Company name | The publisher, such as Contoso Ltd. | Block a publisher's tools when no certificate is available |
| File description | A short description of the program | Target one tool from a publisher |
| Internal name | The name the developer gave the program at build time | Match a program regardless of its current file name |
| Original file name | The file name the program was built with | Stop users who rename a file to get around a block |
| Product name | The product the file belongs to | Block every file in a product |
Use Original file name if users might rename a file to get around Application Block. It's set when the program is built, usually matches the shipped file name, and doesn't change when the file is renamed.
Hash
A Hash rule blocks one exact file by its fingerprint. Supported hash types are Message Digest 5 (MD5), Secure Hash Algorithm 1 (SHA-1), and SHA-256. The file size in bytes must also be entered.
Use Hash to block one specific build of a file and nothing else. Any change to the file, including a new version, produces a different hash, and the rule no longer applies.
Certificate Property
A Certificate Property rule blocks files based on the details of the digital certificate used to sign them. You can match on:
- Common name: The name the certificate was issued to, usually the publisher
- Organization name: The legal organization that owns the certificate
- Organizational unit name: A division within that organization
- Serial number: One specific certificate
Use Certificate Property to block everything a publisher signs, including portable and newly released tools. Signing details are hard to fake, so renaming or repackaging a file doesn't get around this rule. Certificate Property rules don't match unsigned files.
Choose a rule type
Start with a Basic rule when the application is in the list. Use an Advanced rule when needing to block something a Basic rule can't do.
| Goal | Rule type | Why |
|---|---|---|
| Block one installed application, every version | Application | Matches all known variants, even if renamed or moved |
| Block everything from one vendor | Vendor | Covers current and future products from that vendor |
| Block a whole class of software, such as remote access tools | Category | Covers many products without listing each one |
| Block a portable application | File Property (Original file name) or Certificate Property | Portable applications have no installation signature for Basic rules to match |
| Stop users from renaming a file to get around a block | Application, or File Property (Original file name) | Neither depends on the file name on disk |
| Block anything a publisher has signed | Certificate Property | Matches by signing certificate, including new and portable tools |
| Block one exact file and nothing else | Hash | Matches only that exact build |
| Block programs run from a specific folder | File Path | Targets locations, with wildcard support |
| Block an in-house or unrecognized tool | File Property, Certificate Property, or Hash | The application library doesn't include it, so Basic rules can't match it |
Multiple rules can be applied to the same policy. Example: Pair an Application rule for the installed version of a tool with a Certificate Property rule to catch its portable version.
Return to Application Block.