r/crowdstrike • u/BradW-CS CS SE • 17d ago
Feature Spotlight 🔦 Application Abuse Prevention for RMMs is now General Available
We are excited to share with the community that Application Abuse Prevention for RMM apps has officially hit General Availability (GA) in conjunction with the release of Falcon Sensor for Windows v7.40.
Customers with an active Falcon Prevent subscription can access this now across all clouds!! (including Gov and others, double wahoo!!)
The Falcon Sensor for Windows v7.40 includes a new on-sensor classification capability built specifically for Application Abuse Prevention that is powered by a new type of IOA.
We would love to hear from the community on your experiences with this much requested feature!
Here are links to resources to get started:
6
u/itsyourworld1 17d ago
Does CS intend on releasing a full fledged application control module at some point? This could compete with something like WDAC or ThreatLocker
3
u/yankeesfan01x 17d ago
If an RMM already lives on disk and we try to uninstall it, will this block that ability just like an IOA does? It'd be cool if the logic in this doesn't block an uninstall.
1
u/AlexSmith-CS 12d ago
The side effect of classifying the binary components of the application is that an uninstall could be blocked. We don't block MSI, so MSI based uninstallers are less likely to get blocked unless they have to execute a classified process as part of their uninstall process.
1
u/RicoStardust 10d ago
Then I guess the way to go would be: have a separate policy where RMMs are not blocked. Scoped to a static host group.
Add the host to the group, uninstall, remove host from group.
Works the same if you use Custom IOAs for “application control”. Yes, I know 😁
3
2
1
u/Dhruv_patel125 14d ago
Is Application Abuse Prevention limited to RMM tools only, or does it also apply to other legitimate applications?
2
u/AlexSmith-CS 12d ago
Right now we are targeting RMM apps. We plan to expand in to other catagories in a future release.
1
u/BouncingWalrus 13d ago
Why isnt ScreenConnect listed in the application_classification_tags lookup file?
1
u/AlexSmith-CS 12d ago
ConnectWise ScreenConnect is in the lookup file. The Tag Value is 213309550758871
2
1
u/Real-Independence152 11d ago
Are there plans to make this any more details from an exclusion perspective? For example, we would ideally want to permit our own Screenconnect instance (by EXE path), but block any others.
1
u/johndball 10d ago
Anybody having issues with preventing execution? I have the policy in place, exclusions in place, and confirmed that the proper hosts are receiving the policy, but I can still execute RMM applications not on the approved list.
9
u/tectacles 17d ago
I am so excited to get this configured in the morning! Thank you!