Application Block
Application Block stops unauthorized software from launching on Windows endpoints. Block by name, vendor, or entire category — and it’s included free in every ThreatDown bundle.
Application Block — Rules
| Category | Remote Control | Blocked |
| Exclusion | TeamViewer — IT only | Allowed |
| Category | VPN Clients | Blocked |
| Vendor | AnyDesk Software GmbH | Blocked |
Blocked today
attempts
Recent events
ThreatDown bundles include Application Block at no additional cost
ways to target an app: by name, vendor, category, certificate, path, property, or hash
of blocked event records retained, with full CSV export for audits
Why Application Block
Endpoints are exposed the moment an unauthorized executable lands.
Without an execution control layer, any application a user downloads — or an attacker drops — can run on your Windows endpoints. You only find out after the damage is done.
Application Block intercepts unauthorized launches before they execute, logs every attempt with full endpoint context, and lets you carve out exceptions for trusted tools — all from the console you already use.
Capabilities
One rule covers an entire class of applications — Remote Control, VPN Clients, Messaging Tools, and more. Block the category, then carve out exceptions for the specific tools your team relies on. No need to enumerate every app name.
Target any executable by name, vendor, category, certificate property, file path, file metadata, or cryptographic hash (MD5, SHA-1, or SHA-256). Advanced rules reach portable executables and unsigned files that category and name rules cannot.
Every blocked launch is captured with endpoint name, user account, rule, policy, and timestamp. Records are retained for 365 days in Nebula and exportable to CSV. Push blocked-event alerts to email, Slack, or webhook in real time — or as a batched digest at an interval you control.
Application Block runs inside the ThreatDown agent already on your endpoints and is managed from the Nebula or OneView console you already use. No separate deployment, no additional vendor — and no extra cost across all four ThreatDown bundles.
Application Block runs on Windows 10 (version 1607 and later), Windows 11, and Windows Server 2016–2025, using the ThreatDown agent and console you already have.
Block by category and per-app exclusions — no new tools, no separate agent, no extra cost.
Without Application Block
With Application Block
Two AI ecosystems are growing from the same infrastructure: one legitimate, one criminal.
Is your organization prepared?
See Application Block in your environment — included in every ThreatDown bundle.
