Application Control (Windows)

In this article, you will learn everything you need to know about the Application Control module. Application Control has been created to control which processes (or applications) can be executed on client machines and how they are executed. You can define a set of rules that describe what processes are allowed or blocked on the endpoints in your environment using details like Software Name, Paths, Publisher, MD5, Signature, or Wildcard Path. 

1. Description
2. How does Application Control work?
3. HEIMDAL Agent - Application Control
4. Application Control view
5. Application Control settings

DESCRIPTION

Application Control allows you to accelerate your application approval or denial flow for files with a default ruling and create or modify flows for individual users or AD groups. You can handle how a process (it can get automatic elevation from the Privileged Access Management module, if so configured) or a child process (it can allow or block all processes spawned by the process matched by the rule) should run.

HOW DOES APPLICATION CONTROL WORK?

Application Control is a product/service under the HEIMDAL Agent that controls the processes that are allowed to run or not on a computer. It is designed to work on regular Windows clients. Although it can be enabled on Windows Servers as well, it is NOT recommended to have it enabled on servers, as it might cause high CPU usage when the operating system is processing a lot of files/processes/applications. When processes are allowed to run, they can be allowed to run with an Administrator role, and they can be allowed to spawn child processes. Application Control is managed by the Heimdal ProcessLock service that captures every process that is started and checks if it’s allowed to run or not. Control's AppFencing is also 

A. Blocked processes

A process can be blocked from running by creating a block rule in the HEIMDAL Dashboard to match the process in question (a rule can be defined based on Software Name, Paths, Publisher, MD5, Signature, or Wildcard Path). To block a process, Application Control intercepts it and kills it along with all its services in a maximum 5-second interval (processes that are already running when the blocking rule is applied will not be killed, because they are not intercepted when they are already running, but when they are being run). If the blocked process is executed for the first time, the process might start, but it will be killed immediately. During the interception, the process is registered in a blocking repository. When the process is executed a second time, the process won’t start at all, because it is already present in the blocking repository. The intercepting repository consists of a list of items stored in the local Windows Registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options). For each blocked process, Application Control adds a redirect path to a console application (Heimdal.ProcessLock.Trigger.exe) that is run by Application Control instead of running the blocked process. The Heimdal ProcessLock service will log the attempt and send it to HEIMDAL Dashboard, if necessary. Heimdal.ProcessLock.Trigger.exe won’t appear on the user’s screen and will be opened for a few seconds max.

B. Allowed processes

A process can be allowed to run by creating an allow rule in the HEIMDAL Dashboard to match the process in question (a rule can be defined based on Software Name, Paths, Publisher, MD5, Signature, or Wildcard Path). In order to allow a process, Application Control intercepts it and checks the blocking repository to see if the process is blocked or not. If the process is not on the block list, it is allowed to run.

C. Allow with Auto Elevation

In the case of a process that is allowed to run with auto elevation, Application Control intercepts the process that was started as a Standard user (not as Administrator), kills it, and restarts it as an Administrator using the Run with AdminPrivilege functionality (the process is run by the NT Authority\System user). This functionality is independent of the Privileged Access Management module. The blocking repository (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options) is used by the auto-elevation functionality to identify a process that has been configured to be Allowed with Auto Elevate rule in the HEIMDAL Dashboard. The Heimdal.ProcessLock.FileElevator.exe is the console application that runs the process and sends a message to the Heimdal ProcessLock service in order to log the execution and start that process with Administrator permissions.

• When Default File Action is set to Allow, and there aren’t any rules created, Application Control clears all registries that were created/updated by the module. If there are still any rules defined in Group Policy, Application Control will search for each process blocked in registries and remove only those processes that are not blocked anymore (either by default action or rule);
• When it comes to system processes (that are required by the Operating System to run), they are hardcoded to be allowed to run by default;
• Every time a Group Policy update event is triggered, Application Control clears all the registries for this kind of rule(s) and recreates all entries based on Full Path rules;
• When the Heimdal ProcessLock service is stopped, we remove all registry values for those files.

HEIMDAL AGENT - APPLICATION CONTROL

On the HEIMDAL Agent's home page view, you can see the current status of the Agent and the modules that are enabled for your computer. The Application Control module displays information about the Process Name, the Status of each intercepted process, and Timestamp, which represents the time when the process was intercepted.
When an application is intercepted and blocked by Application Control, the HEIMDAL Agent will display a notification on the bottom-right side of the screen:

APPLICATION CONTROL view

The Application Control view displays a table with all the intercepted processes that are running on the computers inside your organization. Newly intercepted processes are visible in the HEIMDAL Dashboard 24 hours after the interception made by the HEIMDAL Agent. The processes that were already intercepted will be displayed in the HEIMDAL Dashboard in real time. At the top, you see a statistic regarding the number of Pending Requests and the number of used Admin Rights.

The collected information is placed in the following views: Standard and Raw Data.

• Standard
  This view displays a table with all the processes (stacked number of executions) that are intercepted by the Application Control module and the following details: Process Name, Number of Executions, Publisher, Software Name, Version, MD5, Status, and Timestamp. The data in this view updates in real-time for the processes that have already been intercepted, but it updates overnight when it comes to newly intercepted processes.
  
• Raw data
  This view displays a table with all the processes (unstacked) that are intercepted by the Application Control module during the last 24 hours of the selected timeframe, with the following details: Hostname, Process Name, Publisher, Software Name, Version, MD5, Status, Deny file permissions, Elevated, and Timestamp. 
  
  If the Ruleset Mode has been set to Reporting Only, processes detected by Application Control will be listed under the Status column with an info bubble containing the tag "R" signifying that the process is being reported, but no action is taken.
  

You can use the “Select GP” drop-down list in both the Standard and Raw data product views, which will facilitate data visualization in the context of high information volumes, allowing you to select one or multiple GPs and filter data accordingly.

Global Update - creates the rule in all existing Group Policies;
Custom Policy Update - creates the rule in the selected Group Policies;
Rule Type - Path (you can specify the process' file path), Software name (you can specify the process' name as it appears in Control Panel -> Programs and Features), MD5 (you can specify the process' MD5 hash), Publisher (the Publisher information is taken from the CN value of the Subject field inside the Certificate of a signed file or the Company Name detail of an unsigned file), Signature (you can specify the process' digital signature thumbprint), Wildcard Path (you can specify a wildcard path), Command Line (C:\Documents\test.pdf, *.pdf, C:\*\My Folder\*.pdf);
Subject - add the value of the selected Rule Type. Selecting a Rule Type will automatically fill in the Subject field;
Priority - rules are processed based on priority numbers (the higher the number is the higher the priority). Leaving gaps between each rule is recommended (10, 20, 30, 40, etc.) to have an easy and neat rule organization, without having to edit existing rules (priority ranges between 0 and 1000);
Allow auto elevation - allows the process to run as Administrator (available only for Allow rules);
Include spawns - allows the process to spawn other child processes (available only for Allow rules). The option must be used only when the Default File Action is set to Block.
The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode corresponding to each view.
The Filters functionality allows you to filter entries by Status. 

Allowed by default: Displays execution events permitted because the Application Control module operates in a permissive mode, or because no restrictive rule matched to prevent execution.
Blocked by default: Displays execution events denied because the system operates under a default-deny (zero-trust) strategy and no explicit allow rule matched the process.
Matching Allowed rules: Filters for processes that were explicitly permitted to run due to matching a policy-defined Allow rule.
Matching Blocked rules: Filters for processes that were explicitly denied execution because they triggered a specific Block rule.
Matching Allowed with auto elevation: Shows processes allowed to run with administrative privileges automatically granted, typically triggered by a specific auto-elevation policy without requiring interactive User Account Control (UAC) prompts.
Matching Allowed by parent process: Displays child processes permitted to execute because their parent process possesses trusted execution permissions or inherited authorization.
Matching Allowed by pre-approved publisher: Displays events where execution was permitted based on the pre-approved publishers' list.

APPLICATION CONTROL SETTINGS

The Application Control module allows you to control how processes (and applications) are executed on the endpoints inside your organization. You can define a set of rules that describe which processes are allowed or blocked on your machines, using details like Software Name, Path, Publisher, MD5, Signature, or Wildcard Path. Application Control can manage how a process runs (it can get automatic elevation from the Heimdal Privilege Elevation and Delegation Management module, if configured) or how a child process runs (it can allow or block all processes spawned by the process defined by the rule).

Application Control - turns the Application Control module ON or OFF.

Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.

General Settings

Application Control driver - installs and uses a kernel mini-filter driver, improving the speed of the ruleset and blocking any process until the rule is processed.
Full Logging Mode - allows the Heimdal Agent to intercept any process(es) running on the endpoints that apply this Group Policy.
User context elevation - installs a kernel mini-filter driver that allows the user to elevate files only under the User context (Run with Admin Privilege under the User context, instead of the System context).
Note 1: To use the "User context elevation" functionality, you need a Privilege Elevation and Delegation Management (PEDM) module license.
Note 2: The "User context elevation" functionality does NOT work if the user is a member of the Network Configuration Operators group. However, Run with Admin Privileges works if the user is moved to any of the following groups: Device Owners, Distributed COM Users, Event Log Readers, Hyper-V Administrators, Access Control Assistance Operators, IIS_IUSR, Network, Performance Log Users, Performance Monitor Users, Power Users, Remote Desktop Users, Remote Management Users, System Managed Accounts Group, Backup Operators.
Allow Privilege Elevation and Delegation Management to bypass the Application Control rule - allows the Privilege Elevation and Delegation Management module to bypass any defined rules (or, when the default action is set to block, through the use of Run with Admin Privilege).
Application Control internal port - allows you to edit the internal port used by the Application Control module (1–65535; the default is 8001).
Allow request approval to run blocked process/file - allows the user to run an Application Control-blocked file with a one-time permission. The file runs without Administrator permissions.
Auto-mode - grants the one-time permissions automatically, without Heimdal Dashboard user intervention.

Rules

Rule enforcement - allows you to turn the ruleset on or off, or to report the processes matched by the defined rules and take action on them:

• Disabled - disables the ruleset.
• Enabled - enables the rules set in the ruleset.
• Reporting mode - intercepts and reports (in the Application Control view) the processes matched by the ruleset, without taking action.

Default file action - selects the default action (Allow or Block) performed when an executed process does not match any rule in the ruleset. System files are allowed to run unless matched by a rule.
When Rule enforcement is set to Enabled and Default file action is set to Block, the Apply default action to scripts option can be enabled, letting you allow the selected script extensions (from Allowlist script extensions) to run regardless of the default file action.

Apply default action to scripts - applies the default action to scripts. This option can be enabled only when Rule enforcement is set to Enabled with Default file action set to Block.
Trusted publishers' allowlist - when enabled, publishers pre-approved by Heimdal are automatically allowlisted unless a specific rule blocks the execution of the process. This option overrules the Block default file action. To block specific publishers from the pre-approved list, click the Full publishers list expand icon. This functionality is also available when using Reporting mode with the default file action set to Block.

Note: To avoid creating duplicate App Control rules (either from the publishers list or manually), rows containing publishers that fall under this situation are highlighted with a blue vertical line, and their checkboxes and action buttons are disabled.

You can add a rule to match a process based on the following:

• Rule value - the value of the rule.
• Friendly name - a friendly name that can be used to search among rules.
• Rule Type - depending on the type, you can specify a Software Name (Microsoft Edge), Path (C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe; may contain a single environment variable in its subject), MD5 (eaa5674047232d4a08e3f5a80ae41847), Publisher (Microsoft Corporation - taken from the CN value of the Subject field in a signed file's certificate, or the Company Name of an unsigned file), Signature (c774204049d25d30af9ac2f116b3c1fb88ee00a4), Wildcard Path (e.g., %ProgramFiles%, %SystemDrive%\Test\*\download.exe, C:\test\*; maximum two * markers), Command Line Arguments (e.g., *.pdf, C:\*\My Folder\*.pdf; maximum two * markers), or Certificate Subject (e.g., CN=Google*, *O=Microsoft*, *L=San Francisco*; maximum two * markers).
• Priority - the higher the priority value, the higher the priority.
• Action - Allow or Block.
• Allow auto elevation - specifies whether the matched process runs under Administrator elevation. For rule types other than Path/Wildcard Path, you need to enable Application Control driver for auto elevation to work.
  Note: Using "Allow auto elevation" requires a Privilege Elevation and Delegation Management (PEDM) module license. For applications on network drives, elevation occurs only if the drive is mapped using an alias rather than an IP address.
• Hide elevated GUI - the elevated process shows a GUI only when actually started by the user.
• Only elevate user input - the process is elevated only when interacted with by the logged-in user.
• Spawns - specifies whether the matched process can spawn child processes. Use this option only when Default file action is set to Block.
• AppFencing - controls lateral movement for each Application Control rule, limiting access to additional resources by managing cross-application interactions, files, data, or Internet access. Enabling it disables the Spawns option (spawn control moves into AppFencing), and it is available only for rules with an Allow action type. Clicking the edit button opens a modal to configure the rule's restrictions.
• Deny file permissions - denies user permissions (Full Control, Read, Write, etc.) when the user tries to access a file matching a rule set to Block.

AppFencing - Network/Internet access

• Available only when the parent rule type is Path or Wildcard; for all other rule types, this tab is greyed out.
• Default block all traffic toggle - adds extra "allow" or "block" rules/exceptions to customize the process's permissions. Its default state is off: when disabled, no action is required until you manually add rules (adding a block rule allows all access except what matches the port or external IP in the rule); when enabled, a general block Firewall rule restricts inbound and outbound Internet access (adding an allow rule permits access only on the provided external IP or port).
• To add a Network/Internet access rule, enter a remote IP or a port, then select the permission type and the rule profile type. The grid lists all manually added rules, with options to edit or delete.

AppFencing - Application interactions

• When enabled, lets you tailor spawn permissions for the corresponding Application Control rule.
• Default block all spawns toggle - its default state is off: when disabled, all spawns are allowed until you add a block rule (all spawns permitted except those matching the block rule); when enabled, all spawns are blocked by default (adding an allow rule keeps spawns blocked except the allowed one). To add a spawn permission, select the rule type and action, then fill in the subject and priority (highest by default, but editable).
  

Processes monitored by AppFencing rules are displayed in the App Control product tables; in the Status column, hovering over the "i" icon shows a tooltip naming the AppFencing rule that determined that state.

In the Ruleset table you can enable Allow auto elevation for a rule to let the matched process run with Administrator permissions (requires the Application Control driver; otherwise it is available only for Path and Wildcard Path rules). The Spawns tickbox allows the process to spawn other processes when Default file action is set to Block. The Deny file permissions tickbox denies user permissions when the user tries to access a file matching a rule set to Block. You can search the rules (by Name, Software Name, or Subject) and use the Download button to export a .csv file of all the rules in the ruleset.
Due to possible performance issues, we recommend keeping the number of rules as low as possible, especially for MD5-type rules. This is also affected by the size of the matched files: the performance cost is not caused by the Heimdal Agent itself but by the MD5 being computed every time the process is launched (especially with large executable files).

Agentic AI Products

Block Agentic AI Products - when enabled, blocks the execution of recognized agentic AI products on the endpoints that apply this Group Policy. (Please confirm the exact scope of this option with the product team.)

Zero-Trust Execution Protection

Note: Zero-Trust Execution Protection reporting mode is enabled by default. We recommend leaving it on for at least 2 weeks for monitoring purposes before disabling reporting mode.

Zero-Trust Execution Protection - enables protection against zero-hour threats compromising your environment (it can also be enabled/disabled from the Endpoint Detection -> Next-Gen Antivirus module). Zero-Trust Execution Protection checks unsigned executable files and blocks their execution if deemed untrusted.
Zero-Trust Execution Protection reporting mode - scans and logs the applications intercepted by Zero-Trust Execution Protection, without taking any action.
Exclusions - allows you to exclude a process from Zero-Trust Execution Protection by File Name, File Path, Directory, or MD5.The Zero-Trust Admin Settings (Enable Zero-Trust driver interception) and the Application Control Admin Settings (Application Control x64 engine) are documented in the Next-Gen Antivirus article, as they belong to the shared Zero-Trust and admin configuration.

IMPORTANT
Microsoft processes present in the system32 folder are allowed by default, but they can be blocked through a block rule in the Application Control ruleset.
MD5 rules are preferred over SHA-256 because MD5 is generally faster, computing small inputs or files in roughly 30% to 50% less CPU time, though disk speed often limits large-file performance.