简体繁体 English

攻击面减少规则阻止应用程序安装

[英]Attack surface reduction rule blocking application installation

原文 2022-05-25 12:54:33 6 1 windows-installer/ windows-security

I have an on-prem application (packaged as windows installer and written in .Net) in which I need to provide silent updation ie, updation to this application should happen in background.我有一个本地应用程序（打包为 Windows 安装程序并用 .Net 编写），我需要在其中提供静默更新，即此应用程序的更新应该在后台进行。 I wrote some code in to do that basically first download the updated file from a URL in background and then installing it in background as well (via spawning a silent msiexec process).我写了一些代码来做，基本上首先从后台的 URL 下载更新的文件，然后在后台安装它（通过产生一个静默的 msiexec 进程）。 This seemed to work and the application was getting updated to newer version as well but after updating the application once if I want to update the application again, ASR rules in windows is blocking the file to update (even when I try to update it manually).I am using windows installer to update the application.这似乎有效，并且应用程序也更新到了较新的版本，但是如果我想再次更新应用程序，在更新应用程序一次后，Windows 中的 ASR 规则会阻止文件更新（即使我尝试手动更新它） .我正在使用 Windows 安装程序来更新应用程序。 Attached are the images that is shown by windows installer and the notification shown by windows security.附件是 windows 安装程序显示的图像和 windows 安全显示的通知。 Can someone help how to resolve this ?有人可以帮助解决这个问题吗？

1 个解决方案

I'm guessing you have some custom actions in the MSI.我猜您在 MSI 中有一些自定义操作。 The first step is to sign all files that trigger anti-virus.第一步是对所有触发防病毒的文件进行签名。 Signing with the same certificate as the application and the MSI is a very strong signal that the code belongs together.使用与应用程序和 MSI 相同的证书进行签名是一个非常强烈的信号，表明代码属于同一类。