Lion Cipher Lab

Lock down Windows execution with AppLocker

• Cyber / Security Engineer
• Intermediate
• ~60 min
• Free · no account required

Why it matters

Almost every piece of commodity malware, and a huge share of ransomware, works the same dull way: something lands a file in a folder the user can write to — Downloads, the Desktop, %TEMP%, %APPDATA% — and then that file runs, because a phishing lure was convincing or an installer was trojanised or a script fetched a second stage. Antivirus tries to catch this with a blocklist: run anything unless a signature recognises it as bad. That model is always one step behind, because a brand-new or lightly-repacked binary has no signature yet. Application allowlisting flips the default the other way:…

What you'll learn

• explaining default-deny application control (allowlisting) versus blocklist antivirus, and why 'only explicitly allowed programs may run' stops the whole class of drop-and-run malware from user-writable paths like Downloads and %TEMP%
• naming the five AppLocker rule collections (Executable, Windows Installer, Script, Packaged apps, DLL) and the three rule conditions (Publisher, Path, File hash) and knowing when each is the right choice
• confirming and configuring the Application Identity service (AppIDSvc), the prerequisite without which AppLocker enforces nothing
• generating the built-in default rules (allow C:\Windows and C:\Program Files, admins full control) with New-AppLockerPolicy -Default or the GUI, and understanding why those paths are safe for standard users but writable ones are not
• rolling out safely with Audit Only mode first, reading the would-have-blocked 8003 events, then switching to Enforce and reading the 8004 block events in the AppLocker event logs
• measuring before/after: the same test program runs from Downloads before the policy and is blocked after, and runs again once moved into Program Files
• stating the honest limits: AppLocker protects standard users but an admin can disable it; LOLBins and trusted-binary abuse bypass naive rule sets; DLL rules are off by default; and App Control for Business (WDAC) is the stronger successor

Steps in this lab

1. Allowlist vs blocklist: why default-deny stops 'invoice.exe from Downloads'
2. The building blocks: five rule collections, three rule conditions, the default rules
3. Turn on the prerequisite (AppIDSvc), then MEASURE BEFORE: run a test file from Downloads
4. Generate the default rules and roll out in AUDIT ONLY mode (the safe path)
5. Switch to ENFORCE and MEASURE AFTER: blocked from Downloads (8004), runs from Program Files
6. The honest limits: admins, LOLBins, DLLs off, and writable trusted paths
7. Do it better: audit first, AppLocker as the on-ramp, WDAC where it gets serious

Open the full interactive lab →