Oh my posh Setup/Uninstall TMP File on a WDAC (Windows Defender Application Control) Enforced System

[SebCT]

Hello!

Concering AppLocker/WDAC i found another issue, would be nice if there is a solution for it in one of the future releases (if possible):

The installation/setup EXE install-amd64.exe, that is code signed (which is awesome and very good!) triggers another TMP File, that is unfortunately still unsigned - i traced it with a self-written WDAC PS Module for threat hunting:

-> \AppData\Local\Temp\WinGet\JanDeDobbeleer.OhMyPosh.9.3.1\install-amd64.exe (signed and easy to allowlist in WDAC/AppLocker, which i already did)

This signed EXE extracts a TMP file, which is also an EXE, in the Temp Folder, and wants to execute it:

-> \AppData\Local\Temp\is-NN4PH.tmp\install-amd64.tmp

This fails if the file hash of this TMP/EXE is not allowlisted - but filehash allowlisting is very time-consuming in the enterprise.

The unsigned EXE has this PE-Header properties:

Would it be possible to sign this also with your code signer certificate? Or maybe another solution without that extracted TMP File? That would be the final step for a perfect solution on enterprise locked-down AppLocker/WDAC workstations, thanks in advance! :-)

[JanDeDobbeleer]

I'll have a look as that's internal to inno installer. My guess is we'll need to tell inno to sign during file creation.

[SebCT]

Thanks! Maybe this thread here helps, too?

https://stackoverflow.com/questions/60148711/internal-inno-setup-installer-does-not-have-product-name-of-main-installer-which

[JanDeDobbeleer]

Solution incoming