Trust Agent scanner signed files on Windows

Some Windows security controls can prevent Agent scanner components from running as intended, reducing scan coverage and reliability. For example, application control, script execution policies, endpoint protection platforms, and other security restrictions. To help make sure scans perform successfully and maintain consistent visibility across your environment, Arctic Wolf recommends that you configure your security controls to trust approved Agent scanner signed files.

For steps to trust these files in:

These resources are required:

  • An Aurora Vulnerability Management (Aurora VM) license.
  • Windows administrative permissions.
  1. Download rse_signature_references.zip.
  2. Using Command Prompt, run this command to verify the hash value of the zip file:
    SHELL 
    certutil -hashfile <zip_file_location> <hash_type>
    Where:
    • <zip_file_location> is the location of the zip file. For example, c:\Users\User_Name\Downloads\rse_signature_references.zip.
    • <hash_type> is the hash type: SHA256, SHA1, or MD5.
    The returned hash value should match one of these options:
    • SHA256 — 977941168282fdaf8a2d0e396fa0cbdced838e2020da3aab6e250ee232120de3
    • SHA1 — d141de57672508e0ec552e303e3726d36b1c016e
    • MD5 — b136740957c44b9ea5a08532d41ceb06
  3. Extract the zip file.
  4. For all Windows endpoints that have Agent installed, complete these steps:
    1. Open the application control software or virus scanning software that is blocking the Agent scan. For example, AppLocker or App Control for Business.
    2. Create rules to trust the appropriate SignatureReference files that are located in the folder that the zip file extracted to.
    3. Save your changes.

Trust Agent scanner signed files in a third-party EDR solution

You can trust the signatures of the Agent scan PowerShell scripts in a third-party EDR solution to improve success with these Agent scans.

  1. Download rse_signature_references.zip.
  2. Using Command Prompt, run this command to verify the hash value of the zip file:
    SHELL 
    certutil -hashfile <zip_file_location> <hash_type>
    Where:
    • <zip_file_location> is the location of the zip file. For example, c:\Users\User_Name\Downloads\rse_signature_references.zip.
    • <hash_type> is the hash type: SHA256, SHA1, or MD5.
    The returned hash value should match one of these options:
    • SHA256 — 977941168282fdaf8a2d0e396fa0cbdced838e2020da3aab6e250ee232120de3
    • SHA1 — d141de57672508e0ec552e303e3726d36b1c016e
    • MD5 — b136740957c44b9ea5a08532d41ceb06
  3. Extract the zip file.
  4. Run this PowerShell command to export the Arctic Wolf certificate:
    CODE 
    Export-Certificate -Cert (Get-AuthenticodeSignature "<signature_reference_path>").SignerCertificate -FilePath "<signature_destination_path>\ArcticWolfNetworksCertificate.cer"
    Where:
    • signature_reference_path is the exact path to the file SignatureReference.ps1.
    • signature_destination_path is the directory path where ArcticWolfNetworksCertificate.cer will be extracted.
  5. Add the Arctic Wolf certificate to the antivirus or EDR exclusion list by following the vendor's recommended configuration guidelines.

Example of how to trust Agent scanner signed files in AppLocker

You can trust the signatures of the Agent scan PowerShell scripts in AppLocker to improve success with these Agent scans.

  1. Download rse_signature_references.zip.
  2. Using Command Prompt, run this command to verify the hash value of the zip file:
    SHELL 
    certutil -hashfile <zip_file_location> <hash_type>
    Where:
    • <zip_file_location> is the location of the zip file. For example, c:\Users\User_Name\Downloads\rse_signature_references.zip.
    • <hash_type> is the hash type: SHA256, SHA1, or MD5.
    The returned hash value should match one of these options:
    • SHA256 — 977941168282fdaf8a2d0e396fa0cbdced838e2020da3aab6e250ee232120de3
    • SHA1 — d141de57672508e0ec552e303e3726d36b1c016e
    • MD5 — b136740957c44b9ea5a08532d41ceb06
  3. Extract the zip file.
  4. On a Windows device, do one of these actions to open the Local Security Policy:
    • Click Start > Programs > Administrative Tools , and then click Local Security Policy.
    • Press Windows Key + R, enter secpol.msc, and then press Enter.
  5. In the navigation pane, expand Application Control Policies, and then expand AppLocker.
  6. Click Script Rules.
  7. Right-click the display pane, and then click Create New Rule.
    The Create Script Rules dialog opens.
  8. Create the script rule:
    1. On the Before You Begin page, click Next.
    2. On the Permissions page, configure these settings, and then click Next:
      • Action — Select Allow.
      • User or group — Select Everyone.
    3. On the Conditions page, select Publisher, and then click Next.
    4. On the Publisher page, click Browse, find the SignatureReference.ps1 file, and then click Open.
    5. Move the slider to the level of enforcement you require. For example, Publisher.
    6. Click Create.
  9. In the navigation pane, click DLL Rules.
  10. Right-click the display pane, and then click Create New Rule.
    The Create DLL Rules dialog opens.
  11. Create the DLL rule:
    1. On the Before You Begin page, click Next.
    2. On the Permissions page, configure these settings, and then click Next:
      • Action — Select Allow.
      • User or group — Select Everyone.
    3. On the Conditions page, select Publisher, and then click Next.
    4. On the Publisher page, click Browse, find the SignatureReference.dll file, and then click Open.
    5. Move the slider to the level of enforcement you require. For example, Publisher.
    6. Click Create.