Skip to content

WDAC Rule Levels Comparison and Guide

This document lists all of the levels of App Control rules. From Top to bottom, from the most secure to the least secure, the levels are:

Neon number Hash

  • File's SHA2-256 Authenticode hash

  • File's SHA2-256 Page hash


horizontal super thin rainbow RGB line


Neon number WHQLFilePublisher

  • One of the Intermediate certificates of the file

  • Leaf certificate of the file

  • File's version

  • Another attribute of the file (FileDescription, InternalName, OriginalFileName, PackageFamilyName, ProductName, Filepath)

  • File's WHQL EKU OID


horizontal super thin rainbow RGB line


Neon number FilePublisher

  • One of the Intermediate certificates of the file

  • Leaf certificate of the file

  • File's version

  • Another attribute of the file (FileDescription, InternalName, OriginalFileName, PackageFamilyName, ProductName, Filepath)


horizontal super thin rainbow RGB line


Neon number WHQLPublisher

  • One of the Intermediate certificates of the file

  • Leaf certificate of the file

  • File's WHQL EKU OID


horizontal super thin rainbow RGB line


Neon number SignedVersion

  • One of the Intermediate certificates of the file

  • Leaf certificate of the file

  • File's version


horizontal super thin rainbow RGB line


Neon number Publisher

  • One of the Intermediate certificates of the file

  • Leaf certificate of the file


horizontal super thin rainbow RGB line


Neon number WHQL

  • Intermediate certificate of the file that belongs to Microsoft as part of the WHQL program

  • File's WHQL EKU OID


horizontal super thin rainbow RGB line


Neon number LeafCertificate

  • Leaf certificate of the file


horizontal super thin rainbow RGB line


Neon number PcaCertificate

  • One of the Intermediate certificates of the file


horizontal super thin rainbow RGB line


Neon number RootCertificate

  • One of the Intermediate certificates of the file


horizontal super thin rainbow RGB line


Neon number Neon number FileName

  • One of the attributes of the file (FileDescription, InternalName, OriginalFileName, PackageFamilyName, ProductName, Filepath)

Important

These properties are mutable.


horizontal super thin rainbow RGB line


Neon number Neon number FilePath

  • Path of the file on disk


horizontal super thin rainbow RGB line


Neon number About SpecificFileNameLevel Options

App Control creates file rules based on file attributes when you scan a folder using a level such as FilePublisher. Each file rule has a MinimumVersion and only one of the six SpecificFileNameLevels.

For instance, suppose a folder has 10 signed files with identical signatures and product names (or File Descriptions etc.). In that case, App Control creates a single file rule with the product name (or File Description etc.) and the lowest version of the 10 files. This file rule is sufficient to allow all 10 files.

The MinimumVersion is the smallest version among the files with the same signature and SpecificFileNameLevel in the folder.

Find more information in Microsoft Learn