Allowing the SuperIT RMM agent in ThreatLocker

If your devices run ThreatLocker, set up these rules before you deploy the agent. Without them, ThreatLocker can block the install, every automatic update, or the fixes SuperIT runs on a device.

How the Agent is Signed

From version 0.1.589, every Windows file we ship is signed with our code signing certificate. The publisher is Super IT Pty Ltd.

The installer puts the agent in C:\Program Files (x86)\SuperIT\agent\ and its data in C:\ProgramData\SuperIT\.

To check a file's signature, run this in PowerShell:

Get-AuthenticodeSignature "C:\Program Files (x86)\SuperIT\agent\superit-agent.exe" |
  Format-List Status, SignerCertificate

Status should be Valid, and the signer's subject should include CN=Super IT Pty Ltd.

Recommended Rules

Trust the Certificate, Not File Hashes

Create a custom application in ThreatLocker that matches the Super IT Pty Ltd certificate, and permit it in your Application Control policy. Limit the certificate match to the install folder, C:\Program Files (x86)\SuperIT\agent\*, so the rule doesn't trust our certificate anywhere else on disk.

Don't rely on file hashes. Every release changes the hash of every file, and the agent updates itself automatically, so a hash rule will block each update until someone approves it.

Only trust files signed by Super IT Pty Ltd. If you find a SuperIT file signed by anyone else, don't allow it and contact us.

Allow Automatic Updates

The agent checks https://updates.superit.ai for new versions. When one is out, it downloads the signed MSI to a superit-update-* folder in the Windows temp folder used by the SYSTEM account (usually C:\Windows\SystemTemp or C:\Windows\Temp), and superit-updater.exe installs it with msiexec.

If your certificate rule is limited to the install folder, add a rule that permits MSIs signed by Super IT Pty Ltd from that temp folder, or updates will be blocked.

Allow the Install Script

Installs, updates and uninstalls run the signed start-service.ps1 through powershell.exe. If you restrict PowerShell scripts, permit this one by its certificate.

Ringfencing

If you ringfence the agent or the updater, allow the applications, network access and files below. Blocking any of them breaks part of SuperIT, often without an obvious error.

Applications superit-agent.exe starts:

• powershell.exe: runs the diagnostics and fixes SuperIT carries out on the device
• superit-updater.exe: installs a downloaded update
• superit-agent.exe: the agent starts a copy of itself in the signed-in user's session when SuperIT needs a screenshot

Applications superit-updater.exe starts:

• powershell.exe: stops the SuperIT service before an update, and starts it again if needed
• msiexec.exe: installs the update MSI

Network access:

• *.superit.ai on port 443 (HTTPS), including updates.superit.ai
• connect.ngs.global on port 4222 (NATS)

Files:

• read and write C:\ProgramData\SuperIT\
• read, write and delete in the SYSTEM account's temp folder, for update downloads

SuperIT runs commands as powershell.exe -Command "<script>", started by superit-agent.exe. Any ringfencing or restrictions you apply to PowerShell also apply to these commands. The script is passed inline rather than as a file, so rules that allow particular script files won't match it.

When the Certificate is Renewed

Our certificate is renewed about once a year. A renewed certificate keeps the same publisher name, Super IT Pty Ltd, but has a new thumbprint. Rules that match the publisher name keep working; rules pinned to the thumbprint need updating after each renewal.

macOS and Linux

This guide covers Windows only. The macOS and Linux agents are not signed with this certificate.

Next Steps: Once your rules are in place, follow the installation guide to deploy the agent.