3 ms·

This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing.

This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently. SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx https://web.archive.org/web/20061219234012/http://blogs.tech... AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<) SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-srp-with-dll-restrictions/ https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr... I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).

longtom 5y ago
It looks like AppLocker is available in Windows Pro, however not configurable via GPOs: https://msendpointmgr.com/2020/09/20/does-applocker-work-in-windows-10-pro-yes-it-does/ https://msendpointmgr.com/2020/09/20/does-applocker-work-in-... Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.
- jve 5y ago
  I opened up the article by just hoping to find this one thing: I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything. That would really simplify things
  - FoolishTech 5y ago
    by default %programfiles% and %programfiles(x86)% are whitelisted, so for most users pretty much that's exactly what they will do with Lockdown, launch it click Enable and that is all that needs to be done. Granted you do need to worry about specifically whitelisting programs not installed to those locations, which are few if any for most people, and actually it wouldn't be a bad feature idea to add an automatic scan for them since some apps insist on running from nested %appdata% folders...
    - GaveDrohl 5y ago
      What stops someone from installing a virus to those locations so that they're automatically whitelisted?
mavhc 5y ago
the 2005 thing requires local admin rights, and the 2008 one allows users to run code they wrote, which I thought we were not doing.
- EvanAnderson 5y ago
  If you've whitelisted an application that can execute arbitrary code (like the Office products with VBA) then SRP can be bypassed by an unprivileged user.
  - mavhc 5y ago
    Which is why Office has a whole set of controls about macros and signing
    - EvanAnderson 5y ago
      Presumably AppLocker is implemented in kernel mode because Microsoft realized that doing the whitelisting in user mode was more fraught with potential escapes. The kernel / user security boundary was one they were already defending (and leveraging hardware functionality in processor privilege levels) so creating a new pseudo-security boundary to defend in user mode was a bad idea. Application-level permissions that aren't enforced by hardware seem like a losing proposition to me. I get that a belt-and-suspenders approach isn't unreasonable, so I guess it's not valueless, but I wouldn't have it as my only line of defense.
      - mavhc 5y ago
        But then they forced you to rent that feature, spooky
miles 5y ago
Thanks for the heads up on Windows Defender Application Control (WDAC); it was new to me. Microsoft appears to have renamed it to Microsoft Defender Application Control (MDAC): Microsoft Defender Application Control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint... Microsoft Defender Application Control https://www.youtube.com/watch?v=r2m156VWg_c https://www.youtube.com/watch?v=r2m156VWg_c Replacing AppLocker with Microsoft Defender Application Control in Windows 10 1903 and later https://www.theexperienceblog.com/2019/10/24/replacing-applocker-with-microsoft-defender-application-control-in-windows-10-1903-and-later/ https://www.theexperienceblog.com/2019/10/24/replacing-applo...

longtom 5y ago

It looks like AppLocker is available in Windows Pro, however not configurable via GPOs: https://msendpointmgr.com/2020/09/20/does-applocker-work-in-windows-10-pro-yes-it-does/ https://msendpointmgr.com/2020/09/20/does-applocker-work-in-... Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.

jve 5y ago
I opened up the article by just hoping to find this one thing: I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything. That would really simplify things
- FoolishTech 5y ago
  by default %programfiles% and %programfiles(x86)% are whitelisted, so for most users pretty much that's exactly what they will do with Lockdown, launch it click Enable and that is all that needs to be done. Granted you do need to worry about specifically whitelisting programs not installed to those locations, which are few if any for most people, and actually it wouldn't be a bad feature idea to add an automatic scan for them since some apps insist on running from nested %appdata% folders...
  - GaveDrohl 5y ago
    What stops someone from installing a virus to those locations so that they're automatically whitelisted?

mavhc 5y ago

the 2005 thing requires local admin rights, and the 2008 one allows users to run code they wrote, which I thought we were not doing.

EvanAnderson 5y ago
If you've whitelisted an application that can execute arbitrary code (like the Office products with VBA) then SRP can be bypassed by an unprivileged user.
- mavhc 5y ago
  Which is why Office has a whole set of controls about macros and signing
  - EvanAnderson 5y ago
    Presumably AppLocker is implemented in kernel mode because Microsoft realized that doing the whitelisting in user mode was more fraught with potential escapes. The kernel / user security boundary was one they were already defending (and leveraging hardware functionality in processor privilege levels) so creating a new pseudo-security boundary to defend in user mode was a bad idea. Application-level permissions that aren't enforced by hardware seem like a losing proposition to me. I get that a belt-and-suspenders approach isn't unreasonable, so I guess it's not valueless, but I wouldn't have it as my only line of defense.
    - mavhc 5y ago
      But then they forced you to rent that feature, spooky

miles 5y ago

Thanks for the heads up on Windows Defender Application Control (WDAC); it was new to me. Microsoft appears to have renamed it to Microsoft Defender Application Control (MDAC): Microsoft Defender Application Control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-protection-windows-10#microsoft-defender-application-control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint... Microsoft Defender Application Control https://www.youtube.com/watch?v=r2m156VWg_c https://www.youtube.com/watch?v=r2m156VWg_c Replacing AppLocker with Microsoft Defender Application Control in Windows 10 1903 and later https://www.theexperienceblog.com/2019/10/24/replacing-applocker-with-microsoft-defender-application-control-in-windows-10-1903-and-later/ https://www.theexperienceblog.com/2019/10/24/replacing-applo...