ETW - AppLocker

Overview

AppLocker is a native Windows feature introduced in Windows 7 Enterprise, designed to replace Software Restriction Policies (SRP). AppLocker enables the restriction and control of executable files that users can run.

AppLocker can control the process creation for the following file types, controlled through 5 sets of rules:

• Executables Rules for executables (.exe and .dom files).

• Scripts Rules for scripts (.ps1, .bat, .cmd, .vbs and .js files).

• Windows Installer Rules for Windows Installers (.msi, .msp and .mst files).

• Packaged Apps Rules for Windows packaged applications (.appx files).

• Shared Libraries and Controls Rules for Dynamic Link Library (.dll and .ocx files).

AppLocker operates on the principle of whitelisting, where files are only allowed to execute or run if they are explicitly allowed by defined rules. Rule sets can be enforced (blocking the execution of files associated with specific types) or configured in audit mode (only generating ETW events).

A computer can implement one or more AppLocker rules that are defined locally (in Local Security Policy) or centrally via one or more Group Policy Object (GPO). The effective rules that are actually implemented on the computer is the sum of all rules defined in Local and Group policies.

Note: for AppLocker to be activated, the AppIDSvc service must be enabled and running.

Default AppLocker rules

AppLocker provides different default rules for each files type category:

• Executables

  The members of the local administrators group (SID S-1-5-32-544) can execute any binaries, while the other users can only execute binaries from the %PROGRAMFILES% and %WINDIR% folders.

• Scripts

Similarly, the default scripts rules allow the members of the local Administrators group (SID S-1-5-32-544) to execute any scripts, while the other users can only execute scripts from the %PROGRAMFILES% and %WINDIR% folders.

• Windows Installer

The default Windows Installers rules allow the members of the local Administrators group (SID S-1-5-32-544) to execute any Windows Installer files, while other users may only execute Windows Installer files that are digitally signed, by any authority, or from the %WINDIR%\Installer\ folder.

• Packaged Apps

By default, any user (Everyone) can execute digitally signed, by any authority, packaged apps.

• Shared Libraries and Controls

The Dynamic Link Libraries (DLL) rules must be enforced through advanced configuration, as they can affect system performance. In a basic AppLocker configuration, DLL rules may not be enforced.

If enforced, the default DLL rules work in the same fashion as the executables and scripts rules. The members of the local administrators group (SID S-1-5-32-544) can load any DLL, while the other users can only load DLLs from the %PROGRAMFILES% and %WINDIR% folders.

Extract AppLocker configuration

The effectively applied AppLocker rules can be retrieved using the Get-AppLockerPolicy PowerShell cmdlet.

An AppLocker rule is defined for an user or group, identified by the UserOrGroupSid attribute, and one or more conditions, which can be a filesystem paths, publishers for digitally signed files, or Authenticode hashes.

Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL"

Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

AppLocker ETW events

The AppLocker channels contain information about executions affected by AppLocker rules. By default no events are generated, as AppLocker events are linked to the state of the AppLocker security mechanism on the system.

The events in the AppLocker channels share a common set of logged properties:

• Policy name and information about the rule that matched: rule identifier, rule name, and rule content in SDDL notation.

• Execution context of the process that triggered the event: SID of the user, session LogonId, and process PID.

• For Executables (executables and DLLs), scripts, and Windows installers rules, information on the file:
  • Filepath.
  • Authenticode file hash.
  • Fully Qualified Binary Name (FQBN) (a string constructed as Company\Product Suite\Product, Version for signed Windows binary files).
• For Packaged Apps: the package app name.

References

• Microsoft - Monitor app usage with AppLocker

• Microsoft - Using Event Viewer with AppLocker

• Splunk - Michael Haag - Deploy, Test, Monitor: Mastering Microsoft AppLocker (Part 2)