AppLocker
{{Short description|Application whitelisting software for Windows}}
{{pp-semi-indef|small=yes}}
AppLocker is an application whitelisting technology introduced with Microsoft's Windows 7 operating system. It allows restricting which programs users can execute based on the program's path, publisher, or hash,{{cite web|title=AppLocker|url=https://technet.microsoft.com/en-us/windows/applocker.aspx|work=Microsoft TechNet|publisher=Microsoft|access-date=23 August 2012}} and in an enterprise can be configured via Group Policy.
Summary
Windows AppLocker allows administrators to control which executable files are denied or allowed to execute. With AppLocker, administrators are able to create rules based on file names, publishers or file location that will allow certain files to execute. Unlike the earlier Software Restriction Policies, which was originally available for Windows XP and Windows Server 2003,{{cite web|title=Using Software Restriction Policies to Protect Against Unauthorized Software|url=https://technet.microsoft.com/en-us/library/bb457006.aspx|work=Microsoft TechNet|date=11 September 2009 |publisher=Microsoft|access-date=27 July 2017}} AppLocker rules can apply to individuals or groups. Policies are used to group users into different enforcement levels. For example, some users can be added to an 'audit' policy that will allow administrators to see the rule violations before moving that user to a higher enforcement level.
AppLocker availability charts
| class="wikitable" style="text-align:center;"
|+ AppLocker availability on Windows 7{{cite web | url=https://technet.microsoft.com/en-us/library/dd759131(v=ws.11).aspx| title=Windows Versions That Support AppLocker | date=17 November 2009 | publisher=Microsoft | access-date=27 July 2017}} | |||||
| ! width=125|Starter | width=125|Home Basic | width=125|Home Premium | width=125|Professional | width=125|Enterprise | width=125| Ultimate |
|---|---|---|---|---|---|
| {{no}} | {{no}} | {{no}} | {{Partial|Create policies, but cannot enforce}} | {{Yes|Create and enforce policies}} | {{Yes|Create and enforce policies}} |
| class="wikitable" style="text-align:center;" | |||
| ! width=125| RT | width=125| (Core) | width=125| Pro | width=125| Enterprise |
|---|---|---|---|
| {{no}} | {{no}} | {{no}} | {{Yes}} |
| class="wikitable" style="text-align:center;"
|+ AppLocker availability on Windows 10{{cite web |url=http://www.neowin.net/news/microsoft-shows-oems-how-to-market-windows-10-talks-features-and-skus |title=Microsoft shows OEMs how to market Windows 10; talks features and SKUs |last1=Dudau |first1=Vlad |date=10 June 2015 |website=Neowin |publisher=Neowin LLC |access-date=19 June 2015}}{{cite web |url=http://www.microsoft.com/en-us/WindowsForBusiness/Compare |title=Find out which Windows is right for you |website=Microsoft |publisher=Microsoft Inc |access-date=2 July 2015}}{{cite web |url=https://support.microsoft.com/en-us/topic/e3a763c9-6a3e-4d9c-8623-0ffe69046470 |title=Removal of Windows edition checks for AppLocker |website=Microsoft |publisher=Microsoft Inc |access-date=22 February 2023}} | |||
| ! width=125|Home | width=125|Pro | width=125|Enterprise | width=125|Education |
|---|---|---|---|
| {{yes}} | {{yes}} | {{yes}} | {{yes}} |
Bypass techniques
There are several generic techniques for bypassing AppLocker:
- Writing an unapproved program to a whitelisted location.
- Using a whitelisted program as a delegate to launch an unapproved program.{{cite web |url=https://pentestlab.blog/2017/05/08/applocker-bypass-installutil/|title=AppLocker Bypass – InstallUtil |website=Penetration Testing Lab |date=8 May 2017 |access-date=27 July 2017}}{{cite web |url=https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html|title=AppLocker Bypass Techniques |website= Evi1cg's blog|date=12 September 2016 |access-date=27 July 2017}}{{cite web |url=http://www.hacking-tutorial.com/hacking-tutorial/how-to-bypass-windows-applocker/#sthash.LBeFrKx7.dpbs|title=How to Bypass Windows AppLocker|website= Hacking Tutorial|date=19 April 2017 |access-date=27 July 2017}}{{cite web|url=https://gist.github.com/caseysmithrc/0b40f1ec0340edd5efe54f1111bba325|title=caseysmithrc/gethelp.cs|website=Github Gist|access-date=14 May 2019|archive-date=14 May 2019|archive-url=https://web.archive.org/web/20190514145515/https://gist.github.com/caseysmithrc/0b40f1ec0340edd5efe54f1111bba325|url-status=dead}}
- Hijacking the DLLs loaded by a trusted application in an untrusted directory.{{cite web |url=https://insights.sei.cmu.edu/cert/2016/06/bypassing-application-whitelisting.html |title=Bypassing Application Whitelisting|website=CERT/CC Blog |date=29 June 2016 |access-date=27 July 2017}}
References
{{Windows Components}}