Question Blacklist Application Control

Please provide comments and solutions that are helpful to the author of this topic.
Parkinsond said:
Could this app represent a good blacklist application control?

www.appcontrol.com

AppControl - Advanced Task Manager with History

Track CPU, memory, disk, Temp, and GPU usage history on your Windows PC. AppControl offers long-term system monitoring and powerful controls beyond Task Manager.
www.appcontrol.com www.appcontrol.com
Click to expand...
Based on the vendor’s own description, this looks more like an “advanced Task Manager + monitoring/alerts” tool than a true “application control” product.

Why it’s probably not a strong “blacklist application control”
  • The site markets AppControl as a historical Task Manager with “controls” like permanently disabling apps and blocking publishers. That usually means it can kill/stop processes and/or disable startup/scheduled tasks, not necessarily prevent code from executing in the first place.
  • Their EULA explicitly describes it as a “simple rule system” that can “disable or kill processes,” and even warns about breaking remote access/critical processes. That wording strongly suggests reactive control (after something starts) rather than OS-enforced execution blocking.
  • Blacklist-style control in general is weaker than allowlisting because attackers can change filenames/hashes, use living-off-the-land binaries, script hosts, side-loading, etc. Even a well-made deny list tends to be bypassable compared to allowlist policies.

What “real” Windows application control usually means
Microsoft’s “application control” (WDAC / App Control for Business, and in some cases AppLocker) is about enforcing what is allowed to run, using Code Integrity-based policy, not just terminating a process after it starts. Microsoft explicitly frames it as moving from “everything runs unless AV says it’s bad” to “only runs if policy allows it.”

So if your goal is actual application control (especially for security hardening), WDAC/App Control for Business (or AppLocker where appropriate) is the category to look at, not a Task Manager-style utility.

Where AppControl (appcontrol.com) can still be useful
It may still be useful as a visibility/response tool:
  • Historical monitoring (CPU/RAM/GPU usage, activity over time)
  • Alerts about “new/unusual apps”
  • Quickly stopping/disable-looping nuisance processes
  • Optional “suspicious app detection” (note: their privacy policy says it can send executable name/hash/publisher details if you enable it)
Just don’t treat that as equivalent to policy-enforced application control.

Practical recommendation
If you want “application control” for security, prefer Windows-native enforcement (WDAC/App Control for Business; possibly AppLocker depending on edition/use case) and keep AV/Defender enabled. Consider AppControl (this app) only as a supplementary monitoring/management tool, not as your primary execution-control layer.

Sources
 
Bot said:
Based on the vendor’s own description, this looks more like an “advanced Task Manager + monitoring/alerts” tool than a true “application control” product.

Why it’s probably not a strong “blacklist application control”
  • The site markets AppControl as a historical Task Manager with “controls” like permanently disabling apps and blocking publishers. That usually means it can kill/stop processes and/or disable startup/scheduled tasks, not necessarily prevent code from executing in the first place.
  • Their EULA explicitly describes it as a “simple rule system” that can “disable or kill processes,” and even warns about breaking remote access/critical processes. That wording strongly suggests reactive control (after something starts) rather than OS-enforced execution blocking.
  • Blacklist-style control in general is weaker than allowlisting because attackers can change filenames/hashes, use living-off-the-land binaries, script hosts, side-loading, etc. Even a well-made deny list tends to be bypassable compared to allowlist policies.

What “real” Windows application control usually means
Microsoft’s “application control” (WDAC / App Control for Business, and in some cases AppLocker) is about enforcing what is allowed to run, using Code Integrity-based policy, not just terminating a process after it starts. Microsoft explicitly frames it as moving from “everything runs unless AV says it’s bad” to “only runs if policy allows it.”

So if your goal is actual application control (especially for security hardening), WDAC/App Control for Business (or AppLocker where appropriate) is the category to look at, not a Task Manager-style utility.

Where AppControl (appcontrol.com) can still be useful
It may still be useful as a visibility/response tool:
  • Historical monitoring (CPU/RAM/GPU usage, activity over time)
  • Alerts about “new/unusual apps”
  • Quickly stopping/disable-looping nuisance processes
  • Optional “suspicious app detection” (note: their privacy policy says it can send executable name/hash/publisher details if you enable it)
Just don’t treat that as equivalent to policy-enforced application control.

Practical recommendation
If you want “application control” for security, prefer Windows-native enforcement (WDAC/App Control for Business; possibly AppLocker depending on edition/use case) and keep AV/Defender enabled. Consider AppControl (this app) only as a supplementary monitoring/management tool, not as your primary execution-control layer.

Sources
Click to expand...
I was asking to get feedback from someone who actually used the app, to avoid "probably".
 
Parkinsond said:
I was asking to get feedback from someone who actually used the app, to avoid "probably".
Click to expand...
I can’t give “I used it and here’s what happened” feedback, because I’m an AI and I don’t have first-hand usage or a lab history that would be honest to present as personal experience.

What I can do is help you get reliable, non-speculative feedback and validate whether it behaves like real blacklist application control.

How to get “actual user” feedback (reliably)
  • Look for long-form user reports (not just star ratings): MalwareTips threads, Wilders Security, Reddit (with skepticism), and GitHub/issue trackers if any exist.
  • Prioritize reports that include: Windows version/build, what exactly was blocked, whether it prevented execution or just terminated after launch, and any bypasses observed.
  • Treat “it blocked my malware” claims as weak unless they include reproducible steps or logs (because outcomes vary heavily by sample, settings, and timing).

How to verify if it’s “blacklist application control” vs “process killer”
Do this in a VM (or at least a throwaway test machine), with snapshots:
  • Create a block rule for a harmless test app (a portable EXE is easiest).
  • Test whether the EXE can start at all:
    • Double-click launch
    • Launch from cmd/PowerShell
    • Launch via scheduled task
    • Launch via another parent process (a launcher)
  • Watch the behavior:
    • If Windows shows a block message and the process never starts, that’s closer to true execution blocking.
    • If the process starts briefly and then is killed, that’s reactive control (much easier to bypass in the real world).
  • Test common bypass angles (still with benign tools):
    • Rename the EXE (filename-based rules break here)
    • Copy to a new folder (path rules break here)
    • Update/recompile to change hash (hash rules break here)
    • Try a signed “publisher” scenario (to see if it truly enforces signer-based rules reliably)

If your end-goal is security hardening
Even if AppControl is useful for visibility and “stop/disable” convenience, the security bar for “application control” is usually “policy-enforced execution control” (on Windows that generally means WDAC / App Control for Business, and sometimes AppLocker depending on edition/use case). Those are designed specifically to prevent execution, not just respond after the fact.

Next step
If you want, post a screenshot of the rule options UI (what match conditions it supports: signer/publisher, hash, path, parent process, script control, etc.) and any block event/log it produces. With that, it’s possible to assess—without guessing—what class of control it really provides and how bypass-resistant it’s likely to be.
 
Zero Knowledge said:
Looks very polished and slick, nice clean website also. Kind of looks like Glass Wire.
Click to expand...
Agree; I wonder if some of MT members tried before.
I need to know before installing, if the rules for blocking apps is premanent or just temporary until W restart.
 
  • Like
Reactions: Zero Knowledge
Looks nice, seems it can warn on service start, MIC access, unsigned app and even suspicious app, so it is more that a taskmanger.

To me it looks like a cross over of Glass Wire and (new) Spyshelter acting as IDS in stead of HIPS.
 
  • Like
Reactions: Parkinsond and Zero Knowledge
Because the blocking is reactive, a malicious app could theoretically execute code before AppControl detects and terminates it.

The "Permanent" blocking relies entirely on AppControl.exe maintaining persistence (Auto-Start) in the Registry.

The rules are saved to a configuration file or registry, meaning they do not disappear when you restart Windows. You do not need to re-block apps every time.

Unlike Windows' native "AppLocker" or "Smart App Control," this software appears to function as a reactive task killer. It must be running in the background to enforce these rules. If the AppControl application is closed, crashed, or removed from startup, the "blocked" apps will be able to run freely.

Do not rely on this for security (e.g., blocking malware or preventing child access). A sophisticated user or malware can easily bypass a user-mode process killer.
 
  • Like
Reactions: Jonny Quest and Zero Knowledge
LinuxFan58 said:
Looks nice, seems it can warn on service start, MIC access, unsigned app and even suspicious app, so it is more that a taskmanger.

To me it looks like a cross over of Glass Wire and (new) Spyshelter acting as IDS in stead of HIPS.
Click to expand...
Tumbled over on Softpedia; I check the website daily as a source of software news.
 
  • Hundred Points
Reactions: LinuxFan58
yeah trouble similitude with glasswire (waiting for a long time for fix release, i consider the actual version in Alpha(n)) and spyshelter, i will pass.
 
  • Like
Reactions: Parkinsond
Looks to be from Jon Hundley the founder of (but no longer with) Glasswire. I saw this the other day and realized I didn't see anyone post it here.


Edit: Man I even searched for this, apparently my searching skills are lacking.

www.pcmag.com

This Free Windows App Shows You Everything Your Computer Is Secretly Doing

I installed AppControl on my Windows 11 PC and was shocked by how much was happening in the background without me knowing.
www.pcmag.com www.pcmag.com

A More Powerful Take on the Task Manager​

Windows 11’s Task Manager lists processes and their current system resource usage, but that’s basically it. Although Microsoft added an App History tab back in Windows 8, it resets when you close the app, so it’s not helpful.

AppControl works differently. It runs in the background, monitoring system resource usage over time, so you can see the data from five minutes ago or yesterday afternoon. It also tracks important events, including application updates, driver installs, new process launches, and webcam access. The software's creator, Jon Hundley, describes it as “a geeky power user tool focused on people who care about PC hardware performance.”
Click to expand...
 
Last edited:
  • Like
Reactions: Jonny Quest and Parkinsond
  • Like
Reactions: Khushal
AppControl Changelog
1.4.0.414 · July 24, 2026

AppControl’s temperature bar for CPU/GPU may now be more colorful due to us optimizing it so it’s easier to notice temperature change ranges.
The memory screen now shows a new visual representation bar of your total memory usage.
Click your mouse center scroll wheel to instantly close any AppControl notifications.
AppControl has colored triangles to show if a process is actively running, and outlined triangles if it is not. You can now mouse over the triangle to understand what it means, along with showing the last time a process ran on your PC.
Our optional MCP server has been updated to work with this improved AppControl Windows version.
When viewing details about an executable in AppControl’s drawer, Windows System Properties are only one click away. Click “system properties” in the executable details drawer in AppControl to open the full Windows properties view.
Get alerted if any application accesses your AppControl MCP server, if you chose to turn that MCP server feature on.
AppControl now supports displaying Windows Services.
AppControl now has an improved method of detecting updated executables that should work more reliably. You may suddenly receive a large number of new executable events immediately after installing this update, due to this change, then things will go back to normal.

www.appcontrol.com

AppControl Changelog

Explore the latest AppControl updates, feature additions, improvements, and bug fixes. Stay up to date with our development progress.
www.appcontrol.com www.appcontrol.com
Click to expand...
 
  • +Reputation
  • Like
Reactions: Khushal and lokamoka820
AppControl Changelog
1.4.0.415 · July 26, 2026

Fixed a bug reported on Discord that caused the temperature graph to display incorrect information in some cases.

www.appcontrol.com

AppControl Changelog

Explore the latest AppControl updates, feature additions, improvements, and bug fixes. Stay up to date with our development progress.
www.appcontrol.com www.appcontrol.com
Click to expand...
 
  • Like
  • +Reputation
Reactions: Zero Knowledge, lokamoka820 and Khushal

You may also like...