try
{
var appcontrolHeartbeat = new Class1();
}
catch (FileLoadException e)
{
log.Info(
$"AppcontrolHeartbeat.dll was blocked. This file is intentionally added to generate a heartbeat signal. Caught by FileLoadException");
}
catch (Exception ex)
{
log.Info($"AppcontrolHeartbeat.dll was blocked. This file is intentionally added to generate a heartbeat signal. Caught by {ex.Source}");
}
The generation of new Class1 fails on devices that have applocker or Windows Defender Application Control is enforced. It’s ok that the new Class1 call fails, it is intentional to make sure Application allowlisting is functional.
However for some reason the code above throws an unhandled exception which is puzzling to me and not what I am trying to achieve. The exception seems clearly handled to me. I want the code with a bunch of steps after this part.
Anyone have an idea why this would be treated as unhandled? This is a dotnet core app should that make a difference.
Thanks,
Kim
.WDACEventLogCollectorCore.exe
Unhandled exception. System.IO.FileLoadException: Could not load file or assembly ‘C:UsersUserProfileOneDriveWDACLogCollectorCorenet8.0-windows10.0.19041.0AppControlHeartbeat.dll’. Your organization used Device Guard to block this app. Contact your support person for more info. (0x800711C7)
File name: ‘C:UsersUserProfileOneDriveWDACLogCollectorCorenet8.0-windows10.0.19041.0AppControlHeartbeat.dll’
at WDACEventLogCollector.Program.Main(String[] args)