Option 3 — Enabled Mode (Default)#

1
flowchart LR
2
    classDef audit fill:#1a1a0d,color:#fde68a,stroke:#713f12
3
    classDef enforce fill:#0d1f12,color:#86efac,stroke:#166534
4
    classDef risk fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
5

6
    A([No Policy\nFull exposure]):::risk --> B([Audit Mode Policy\nLearning phase\nZero disruption]):::audit
7
    B --> C([Refined Policy\nAudit Mode\nValidation phase]):::audit
8
    C --> D([Enforced Policy\nProduction\nFull protection]):::enforce
9

10
    style A fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
11
    style B fill:#1a1a0d,color:#fde68a,stroke:#713f12
12
    style C fill:#1a1a0d,color:#fde68a,stroke:#713f12
13
    style D fill:#0d1f12,color:#86efac,stroke:#166534

1
flowchart LR
2
    classDef audit fill:#1a1a0d,color:#fde68a,stroke:#713f12
3
    classDef enforce fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
4
    classDef allow fill:#0d1f12,color:#86efac,stroke:#166534
5

6
    subgraph Audit_Mode["Audit Mode (Option 3 Set)"]
7
        direction TB
8
        A1([Unauthorized binary]) --> B1([Policy evaluates]):::audit
9
        B1 --> C1([Would block? YES]):::audit
10
        C1 --> D1([Binary RUNS anyway]):::allow
11
        D1 --> E1([Event 3076 logged]):::audit
12
    end
13

14
    subgraph Enforce_Mode["Enforcement Mode (Option 3 Removed)"]
15
        direction TB
16
        A2([Unauthorized binary]) --> B2([Policy evaluates]):::enforce
17
        B2 --> C2([Would block? YES]):::enforce
18
        C2 --> D2([Binary BLOCKED]):::enforce
19
        D2 --> E2([Event 3077 logged]):::enforce
20
    end

1
<?xml version="1.0" encoding="utf-8"?>
2
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy" PolicyType="Base Policy">
3

4
  <VersionEx>10.0.1.0</VersionEx>
5
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
6
  <PlatformID>{2E07F7E4-194C-4D20-B96C-1498495910E7}</PlatformID>
7

8
  <Rules>
9
    <Rule>
10
      <Option>Enabled:UMCI</Option>
11
    </Rule>
12

13
    <Rule>
14
      <Option>Enabled:Audit Mode</Option>
15
    </Rule>
16

17
  </Rules>
18

19

20
</SiPolicy>

1
<Rules>
2
  <Rule>
3
    <Option>Enabled:UMCI</Option>
4
  </Rule>
5

6

7
</Rules>

1
stateDiagram-v2
2
    direction LR
3

4
    [*] --> NoPolicyState: Endpoint with no WDAC policy
5

6
    NoPolicyState --> AuditPhase1: Deploy policy\n+ Option 3 (Audit Mode)
7
    AuditPhase1 --> DataCollection: 2-4 weeks\nevent collection
8

9
    DataCollection --> PolicyRefinement: Analyze 3076/3033 events\nGenerate supplemental
10

11
    PolicyRefinement --> AuditPhase2: Deploy refined policy\nstill with Option 3
12

13
    AuditPhase2 --> Validation: Validation period\n1-2 weeks
14

15
    Validation --> EnforcedState: Remove Option 3\nDeploy enforced policy
16

17
    EnforcedState --> [*]: Active enforcement
18

19
    EnforcedState --> AuditPhase1: New software rollout\nRe-enter audit cycle
20

21
    note right of AuditPhase1
22
        Event ID 3076 (user-mode)
23
        Event ID 3033 (kernel-mode)
24
        Binary RUNS despite violation
25
    end note
26

27
    note right of EnforcedState
28
        Event ID 3077 (user-mode)
29
        Event ID 3034 (kernel-mode)
30
        Binary BLOCKED on violation
31
    end note

1
sequenceDiagram
2
    autonumber
3
    actor CISO
4
    actor Admin
5
    participant Intune as Microsoft Intune
6
    participant TestRing as Test Ring (50 endpoints)
7
    participant EventLog as Event Log / SIEM
8
    participant CIModule as ConfigCI PowerShell
9
    participant PilotRing as Pilot Ring (500 endpoints)
10
    participant ProdFleet as Production Fleet (5000 endpoints)
11

12
    CISO ->> Admin: Requirement: WDAC on all endpoints within 60 days
13
    Admin ->> CIModule: Create policy: DefaultWindows + Option 0 (UMCI) + Option 3 (Audit)
14
    Admin ->> CIModule: ConvertFrom-CIPolicy → corp_audit_v1.cip
15
    Admin ->> Intune: Deploy corp_audit_v1.cip to Test Ring (50 devices)
16
    TestRing ->> EventLog: Generate 3076 events for 2 weeks
17
    Admin ->> EventLog: Export and analyze 3076 events
18
    EventLog -->> Admin: 47 unique binaries would have been blocked
19
    Admin ->> CIModule: New-CIPolicy -Audit → supplemental_from_audit.xml
20
    Admin ->> CIModule: Merge base + supplemental → corp_audit_v2.xml
21
    Admin ->> Intune: Deploy corp_audit_v2.cip to Test Ring
22
    TestRing ->> EventLog: Generate 3076 events for 1 more week
23
    EventLog -->> Admin: 3 remaining edge-case binaries
24
    Admin ->> CIModule: Add remaining signers/hashes manually
25
    Admin ->> CIModule: Remove Option 3 → corp_enforced_v1.xml
26
    Admin ->> Intune: Deploy corp_enforced_v1.cip to Pilot Ring (500 devices)
27
    PilotRing -->> Admin: Monitor for 3077 events — 2 false positives found
28
    Admin ->> CIModule: Add 2 missing file rules → corp_enforced_v2.xml
29
    Admin ->> Intune: Staged rollout to Production Fleet (5000 devices)
30
    ProdFleet -->> CISO: 100% WDAC enforced — 0 operational incidents

1
sequenceDiagram
2
    autonumber
3
    actor Admin
4
    participant EventLog as Windows Event Log
5
    participant PowerShell as PowerShell Analysis
6
    participant ExcelCSV as CSV / Excel Report
7
    participant PolicyXML as Policy XML
8

9
    Admin ->> EventLog: Query Event ID 3076 for past 14 days
10
    EventLog -->> PowerShell: Return raw events (potentially thousands)
11
    PowerShell ->> PowerShell: Group by Publisher → deduplicate
12
    PowerShell ->> PowerShell: Prioritize: signed > unsigned > by path
13
    PowerShell ->> ExcelCSV: Export grouped report
14
    Admin ->> ExcelCSV: Review — identify business-critical apps vs noise
15
    Admin ->> PolicyXML: Add FilePublisher rules for signed trusted apps
16
    Admin ->> PolicyXML: Add Hash rules for unsigned but required binaries
17
    Admin ->> PolicyXML: Flag unknown binaries for security review
18
    PolicyXML -->> Admin: Refined policy ready for re-audit deployment

1
flowchart TD
2
    classDef block fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
3
    classDef warn fill:#1a1a0d,color:#fde68a,stroke:#713f12
4
    classDef ok fill:#0d1f12,color:#86efac,stroke:#166534
5

6
    A([Audit Mode left in production policy]) --> B{Malware executes}
7
    B --> C([Policy evaluates binary]):::warn
8
    C --> D([No allow rule match]):::warn
9
    D --> E([Audit Mode: Binary RUNS anyway]):::block
10
    D --> F([Event 3076 written to log]):::warn
11
    E --> G([Malware executes successfully]):::block
12
    G --> H([Data breach / ransomware]):::block
13
    F --> I([Alert in SIEM — too late]):::warn
14
    H --> J([Incident response triggered]):::block
15
    J --> K([Audit Mode discovered in policy review]):::warn
16
    K --> L([Policy corrected post-breach]):::block

1
flowchart TD
2
    classDef block fill:#1f0d0d,color:#fca5a5,stroke:#7f1d1d
3
    classDef warn fill:#1a1a0d,color:#fde68a,stroke:#713f12
4

5
    A([Remove Audit Mode after only 3 days]) --> B[Insufficient audit coverage]:::warn
6
    B --> C([Policy enforced on day 4])
7
    C --> D[Monthly payroll software runs\nnot captured in 3-day audit]:::block
8
    C --> E[Quarterly compliance tool runs\nnot captured]:::block
9
    C --> F[Seasonal inventory software\nnot captured]:::block
10
    D --> G([Payroll fails on month-end]):::block
11
    E --> H([Compliance audit failure]):::block
12
    F --> I([Inventory count disrupted]):::block