Lesson 3.1: Reviewing an application allow-list
Application allow-listing (AppLocker, or the stronger App Control for Business, formerly WDAC) lets Windows run only approved programs. It's among the most effective controls against malware, and among the easiest to undermine: one convenient path rule for a user-writable folder, or scripts left in audit mode, and attackers walk around it. In the lab you review the effective AppLocker policy and event logs exported from a finance workstation, find the rule that let malware run from a Temp folder, see scripts that were only audited, and prepare a corrected policy.
16 min
You will learn to
- Explain application allow-listing
- Read AppLocker rule collections and enforcement modes
- Spot rules for user-writable paths
- Read AppLocker events 8002/8004/8006
- Prepare a corrected policy
Key terms
- Application allow-listing
- Only approved programs may run; everything else is blocked.
- AppLocker / App Control for Business
- Windows allow-listing features; App Control (formerly WDAC) is the stronger, kernel-enforced one.
- Rule collection
- AppLocker rules per file type: Exe, Script, Dll, Msi, Appx; each with its own enforcement mode.
- Path / publisher / hash rule
- Allow by location, by code-signing publisher, or by exact file hash.
- Events 8002 / 8004 / 8006
- Executable allowed / executable blocked / script would have been blocked (audit).
← Dangerous file permissions · All lessons · The same-origin policy and CORS →