Applocker
AppLocker is an application whitelisting technology introduced with Microsoft's Windows 7 operating system.
It allows restricting which programs users can execute based on the program's path, publisher, or hash, and in an enterprise can be configured via Group Policy.
Summary
Windows AppLocker allows administrators to control which executable files are denied or allowed to execute. With AppLocker, administrators are able to create rules based on file names, publishers or file location that will allow certain files to execute. Unlike the earlier Software Restriction Policies, which was originally available for Windows XP and Windows Server 2003, AppLocker rules can apply to individuals or groups. Policies are used to group users into different enforcement levels. For example, some users can be added to an 'audit' policy that will allow administrators to see the rule violations before moving that user to a higher enforcement level.
AppLocker availability charts
| Starter | Home Basic | Home Premium | Professional | Enterprise | Ultimate |
|---|---|---|---|---|---|
| No | No | No | Create policies, but cannot enforce | Create and enforce policies | Create and enforce policies |
| RT | (Core) | Pro | Enterprise |
|---|---|---|---|
| No | No | No | Yes |
| Home | Pro | Enterprise | Education |
|---|---|---|---|
| Yes | Yes | Yes | Yes |
Bypass techniques
There are several generic techniques for bypassing AppLocker:
- Writing an unapproved program to a whitelisted location.
- Using a whitelisted program as a delegate to launch an unapproved program.
- Hijacking the DLLs loaded by a trusted application in an untrusted directory.
References
This article uses material from the Wikipedia English article AppLocker, which is released under the Creative Commons Attribution-ShareAlike 3.0 license ("CC BY-SA 3.0"); additional terms may apply (view authors). Content is available under CC BY-SA 4.0 unless otherwise noted. Images, videos and audio are available under their respective licenses.
®Wikipedia is a registered trademark of the Wiki Foundation, Inc. Wiki English (DUHOCTRUNGQUOC.VN) is an independent company and has no affiliation with Wiki Foundation.