It would be great to be able to manually blacklist applications from running, either by name, path, hash or certificate.

We are currently investigating ways to do this and had to resort to a custom C# application that we install as service. Threatlocker, AutoElevate and now Blackpoint cyber all have this feature as part of their services. It would be a huge value add and I would hate to have to sign up for another service from yet another vendor.