Application modification detection

The application modification detection feature displays notifications if modified applications, for which a firewall rule exists, attempt to establish connections. This is useful to avoid abusing rules configured for some application by another application by temporarily or permanently replacing the original application's executable file with the other applications executable file, or by maliciously modifying the original application's executable file.

This feature is not meant to detect modifications to any application in general. The goal is to avoid abusing existing firewall rules, and only applications for which specific firewall rules exist are monitored.

Enable detection of application modifications—If selected, the program will monitor applications for changes (updates, infections, other modifications). When a modified application attempts to establish a connection, you will be notified by the firewall.

Allow modification of signed (trusted) applications—Do not notify if the application has the same valid digital signature before and after the modification.

List of applications excluded from checking—You can add or remove individual applications for which modifications are allowed without notification.