Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1012375" data-attributes="member: 32260">Updated ApplockerHome policy file.Added some block rules for LOLBins and Windows writable folders. The policy includes:cipher.exe, hh.exe, installutil.exe, jsc.exe, microsoft.workflow.compiler.exe, msbuild.exe, mshta.exe, powershell.exe, powershell_ise.exe, presentationhost.exe, regsvcs.exe,&nbsp; runas.exe, wmic.exe.The LOLBins are blocked by a publisher rule, so they cannot be executed after copying to another location or changing the file name.Three LOLBins are configured to be allowed (hh.exe, powershell.exe, powershell_ise.exe) due to a trick. I intentionally put the fake publisher name (for example HomeApplocker:HH.EXE). The LOLBin (like hh.exe) is going to be blocked after replacing the fake publisher name with an asterisk, for example:HomeApplocker:HH.EXE -----&gt; * Blocked execution (for EXE, DLL, Script) in Windows folders:%WINDIR%\debug\wia%WINDIR%\registration\crmlog%SYSTEM32%\com\dmp%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\%SYSTEM32%\drivers\driverdata%SYSTEM32%\fxstmp%SYSTEM32%\microsoft\crypto\rsa\machinekeys%SYSTEM32%\spool\drivers\color%SYSTEM32%\spool\printers%SYSTEM32%\spool\servers%SYSTEM32%\tasks%SYSTEM32%\tasks_migrated%WINDIR%\tasks%WINDIR%\temp%WINDIR%\tracingThe policy code:[CODE]&lt;#.SYNOPSIS&nbsp; &nbsp; This function creates new AppLocker settings using MDM WMI Bridge.&nbsp; &nbsp; All previous rules will be deleted.&nbsp; &nbsp; ** EXE and DLL rules block also Administrators. Allow rules:&nbsp; &nbsp; Allow all files in the Program Files folder&nbsp; &nbsp; Allow all files in the Windows folder (with some exceptions)&nbsp; &nbsp; Allow all signed&nbsp; &nbsp; Block some LOLBins&nbsp; &nbsp; ** MSI rules do not block Administrators. Allow rules:&nbsp; &nbsp; All files in the folder %systemdrive%\Windows\Installer&nbsp; &nbsp; Allow all signed&nbsp; &nbsp; ** Script rules do not block Administrators. Allow rules:&nbsp; &nbsp; Allow all files in the Program Files folder&nbsp; &nbsp; Allow all files in the Windows folder (with some exceptions)&nbsp; &nbsp; ** StoreApps rule blocks also Administrators. Allow rule:&nbsp; &nbsp; Allow all signed&nbsp; .CREDITS&nbsp; &nbsp; These scripts are based on the script for EXE files made by Sandy Zeng (Sandy Tsang).&nbsp; &nbsp; https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker#&gt;$namespaceName = &quot;root\cimv2\mdm\dmmap&quot; #Do not change this$GroupName = &quot;AppLocker001&quot; #Your own groupName$parentID = &quot;./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName&quot;$classNameDLL = &quot;MDM_AppLocker_DLL03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;DLL&#039;&quot;&nbsp; | Remove-CimInstance$classNameEXE = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;EXE&#039;&quot;&nbsp; | Remove-CimInstance$classNameMSI = &quot;MDM_AppLocker_MSI03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;MSI&#039;&quot;&nbsp; | Remove-CimInstance$classNameScript = &quot;MDM_AppLocker_Script03&quot; #Do not change thisGet-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Script&#039;&quot;&nbsp; | Remove-CimInstance$classNameStoreApps = &quot;MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03&quot;Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter &quot;ParentID=`&#039;$parentID`&#039; and InstanceID=&#039;Storeapps&#039;&quot;&nbsp; | Remove-CimInstanceAdd-Type -AssemblyName System.Web#This is example Rule Collection for EXE$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Exe&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;dcff703a-6dbd-48f5-8ce3-94f8228b6ac4&quot; Name=&quot;Wszystkie pliki znajdujące się w folderze Windows&quot; Description=&quot;Umożliwia członkom grupy Wszyscy wykonywanie aplikacji znajdujących się w folderze Windows.&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp;&nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp;&nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot;/&gt;&nbsp; &nbsp;&nbsp; &lt;/Conditions&gt;&nbsp; &nbsp;&nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\debug\wia\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\com\dmp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\drivers\driverdata\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\fxstmp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\microsoft\crypto\rsa\machinekeys\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\drivers\color\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\printers\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\servers\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\tasks_migrated\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp;&nbsp; &lt;/Exceptions&gt;&nbsp;&nbsp; &lt;/FilePathRule&gt;&nbsp;&nbsp; &lt;FilePathRule Id=&quot;921cc481-6e17-4653-8f75-050b80acca20&quot; Name=&quot;Allow files in the Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp;&nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;9ab086ea-40a8-4b05-875b-f9fdf9962ba8&quot; Name=&quot;Allow signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96000&quot; Name=&quot;POWERSHELL.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;HomeApplocker:POWERSHELL.EXE&quot; BinaryName=&quot;POWERSHELL.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96001&quot; Name=&quot;POWERSHELL_ISE.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;HomeApplocker:POWERSHELL_ISE.EXE&quot; BinaryName=&quot;POWERSHELL_ISE.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96003&quot; Name=&quot;RUNAS.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;RUNAS.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96004&quot; Name=&quot;CIPHER.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;CIPHER.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96005&quot; Name=&quot;MSBUILD.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;MSBUILD.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96006&quot; Name=&quot;InstallUtil.exe&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;InstallUtil.exe&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96007&quot; Name=&quot;REGSVCS.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;REGSVCS.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96008&quot; Name=&quot;WMIC.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;WMIC.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a96009&quot; Name=&quot;PRESENTATIONHOST.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;PRESENTATIONHOST.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a9600a&quot; Name=&quot;JSC.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;JSC.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a9600b&quot; Name=&quot;MSHTA.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;MSHTA.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a9600c&quot; Name=&quot;MICROSOFT.WORKFLOW.COMPILER.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;MICROSOFT.WORKFLOW.COMPILER.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a9600d&quot; Name=&quot;HH.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;HomeApplocker:HH.EXE&quot; BinaryName=&quot;HH.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID=&quot;EXE&quot;;Policy=$obj}#This is example Rule Collection for MSI$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Msi&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;b7af7102-efde-4369-8a89-7a6a392d1473&quot; Name=&quot;Allow all signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;5b290184-345a-4453-b184-45305f6d9a54&quot; Name=&quot;Allow files in the folder %systemdrive%\Windows\Installer.&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\Installer\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;64ad46ff-0d71-4fa0-a30b-3f3d30c5433d&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID=&quot;MSI&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Script&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;06dce67b-934c-454f-a263-2515c8796a5d&quot; Name=&quot;Allow scripts in Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;9428c672-5fc3-47f4-808a-a0011f36dd2c&quot; Name=&quot;Allow scripts in Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp;&nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\debug\wia\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\com\dmp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\drivers\driverdata\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\fxstmp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\microsoft\crypto\rsa\machinekeys\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\drivers\color\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\printers\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\servers\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\tasks_migrated\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp;&nbsp; &lt;/Exceptions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;ed97d0cb-15ff-430f-b82c-8d7832957725&quot; Name=&quot;Allow for Administrators&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-5-32-544&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Property @{ParentID=$parentID;InstanceID=&quot;Script&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Dll&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;bac4b0bf-6f1b-40e8-8627-8545fa89c8b6&quot; Name=&quot;Allow DLLs in Windows folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp;&nbsp; &lt;Exceptions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\debug\wia\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\registration\crmlog\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\com\dmp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\drivers\driverdata\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\fxstmp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\microsoft\crypto\rsa\machinekeys\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\drivers\color\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\printers\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\spool\servers\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%SYSTEM32%\tasks_migrated\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tasks\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%WINDIR%\tracing\*&quot; /&gt;&nbsp; &nbsp;&nbsp; &lt;/Exceptions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePathRule Id=&quot;3737732c-99b7-41d4-9037-9cddfb0de0d0&quot; Name=&quot;Allow DLLs in Program Files folder&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%PROGRAMFILES%\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;1f0d0ec5-8523-4aa0-976a-ad2d2c21eed7&quot; Name=&quot;Allow all Signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID=&quot;DLL&quot;;Policy=$obj}$obj = [System.Net.WebUtility]::HtmlEncode(@&quot;&nbsp; &lt;RuleCollection Type=&quot;Appx&quot; EnforcementMode=&quot;Enabled&quot;&gt;&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;a9e18c21-ff8f-43cf-b9fc-db40eed693ba&quot; Name=&quot;All signed&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;*&quot; ProductName=&quot;*&quot; BinaryName=&quot;*&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;0.0.0.0&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;&nbsp; &lt;/RuleCollection&gt;&quot;@)New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID=&quot;Storeapps&quot;;Policy=$obj}[/CODE]Warning!!!I strongly recommend making a System Restore Point before applying the Applocker rules.</blockquote>

[QUOTE="Andy Ful, post: 1012375, member: 32260"] [B]Updated ApplockerHome policy file.[/B] Added some block rules for LOLBins and Windows writable folders. The policy includes: cipher.exe, hh.exe, installutil.exe, jsc.exe, microsoft.workflow.compiler.exe, msbuild.exe, mshta.exe, powershell.exe, powershell_ise.exe, presentationhost.exe, regsvcs.exe, runas.exe, wmic.exe. The LOLBins are blocked by a publisher rule, so they cannot be executed after copying to another location or changing the file name. Three LOLBins are configured to be allowed (hh.exe, powershell.exe, powershell_ise.exe) due to a trick. I intentionally put the fake publisher name (for example [B][COLOR=rgb(41, 105, 176)]HomeApplocker:HH.EXE[/COLOR][/B]). The LOLBin (like hh.exe) is going to be blocked after replacing the fake publisher name with an asterisk, for example: [B][COLOR=rgb(41, 105, 176)]HomeApplocker:HH.EXE[/COLOR] ----->[/B][COLOR=rgb(0, 168, 133)] * [/COLOR] Blocked execution (for EXE, DLL, Script) in Windows folders: %WINDIR%\debug\wia %WINDIR%\registration\crmlog %SYSTEM32%\com\dmp %SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\ %SYSTEM32%\drivers\driverdata %SYSTEM32%\fxstmp %SYSTEM32%\microsoft\crypto\rsa\machinekeys %SYSTEM32%\spool\drivers\color %SYSTEM32%\spool\printers %SYSTEM32%\spool\servers %SYSTEM32%\tasks %SYSTEM32%\tasks_migrated %WINDIR%\tasks %WINDIR%\temp %WINDIR%\tracing The policy code: [CODE]<# .SYNOPSIS This function creates new AppLocker settings using MDM WMI Bridge. All previous rules will be deleted. ** EXE and DLL rules block also Administrators. Allow rules: Allow all files in the Program Files folder Allow all files in the Windows folder (with some exceptions) Allow all signed Block some LOLBins ** MSI rules do not block Administrators. Allow rules: All files in the folder %systemdrive%\Windows\Installer Allow all signed ** Script rules do not block Administrators. Allow rules: Allow all files in the Program Files folder Allow all files in the Windows folder (with some exceptions) ** StoreApps rule blocks also Administrators. Allow rule: Allow all signed .CREDITS These scripts are based on the script for EXE files made by Sandy Zeng (Sandy Tsang). https://github.com/sandytsang/MSIntune/tree/master/Intune-PowerShell/AppLocker #> $namespaceName = "root\cimv2\mdm\dmmap" #Do not change this $GroupName = "AppLocker001" #Your own groupName $parentID = "./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/$GroupName" $classNameDLL = "MDM_AppLocker_DLL03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Filter "ParentID=`'$parentID`' and InstanceID='DLL'" | Remove-CimInstance $classNameEXE = "MDM_AppLocker_ApplicationLaunchRestrictions01_EXE03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Filter "ParentID=`'$parentID`' and InstanceID='EXE'" | Remove-CimInstance $classNameMSI = "MDM_AppLocker_MSI03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Filter "ParentID=`'$parentID`' and InstanceID='MSI'" | Remove-CimInstance $classNameScript = "MDM_AppLocker_Script03" #Do not change this Get-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Filter "ParentID=`'$parentID`' and InstanceID='Script'" | Remove-CimInstance $classNameStoreApps = "MDM_AppLocker_ApplicationLaunchRestrictions01_StoreApps03" Get-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Filter "ParentID=`'$parentID`' and InstanceID='Storeapps'" | Remove-CimInstance Add-Type -AssemblyName System.Web #This is example Rule Collection for EXE $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Exe" EnforcementMode="Enabled"> <FilePathRule Id="dcff703a-6dbd-48f5-8ce3-94f8228b6ac4" Name="Wszystkie pliki znajdujące się w folderze Windows" Description="Umożliwia członkom grupy Wszyscy wykonywanie aplikacji znajdujących się w folderze Windows." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*"/> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\debug\wia\*" /> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%SYSTEM32%\com\dmp\*" /> <FilePathCondition Path="%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\*" /> <FilePathCondition Path="%SYSTEM32%\drivers\driverdata\*" /> <FilePathCondition Path="%SYSTEM32%\fxstmp\*" /> <FilePathCondition Path="%SYSTEM32%\microsoft\crypto\rsa\machinekeys\*" /> <FilePathCondition Path="%SYSTEM32%\spool\drivers\color\*" /> <FilePathCondition Path="%SYSTEM32%\spool\printers\*" /> <FilePathCondition Path="%SYSTEM32%\spool\servers\*" /> <FilePathCondition Path="%SYSTEM32%\tasks\*" /> <FilePathCondition Path="%SYSTEM32%\tasks_migrated\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="921cc481-6e17-4653-8f75-050b80acca20" Name="Allow files in the Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePublisherRule Id="9ab086ea-40a8-4b05-875b-f9fdf9962ba8" Name="Allow signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96000" Name="POWERSHELL.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="HomeApplocker:POWERSHELL.EXE" BinaryName="POWERSHELL.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96001" Name="POWERSHELL_ISE.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="HomeApplocker:POWERSHELL_ISE.EXE" BinaryName="POWERSHELL_ISE.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96003" Name="RUNAS.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="RUNAS.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96004" Name="CIPHER.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="CIPHER.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96005" Name="MSBUILD.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="MSBUILD.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96006" Name="InstallUtil.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="InstallUtil.exe"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96007" Name="REGSVCS.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="REGSVCS.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96008" Name="WMIC.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="WMIC.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a96009" Name="PRESENTATIONHOST.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="PRESENTATIONHOST.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a9600a" Name="JSC.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="JSC.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a9600b" Name="MSHTA.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="MSHTA.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a9600c" Name="MICROSOFT.WORKFLOW.COMPILER.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="MICROSOFT.WORKFLOW.COMPILER.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a9600d" Name="HH.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="HomeApplocker:HH.EXE" BinaryName="HH.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameEXE -Property @{ParentID=$parentID;InstanceID="EXE";Policy=$obj} #This is example Rule Collection for MSI $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Msi" EnforcementMode="Enabled"> <FilePublisherRule Id="b7af7102-efde-4369-8a89-7a6a392d1473" Name="Allow all signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePathRule Id="5b290184-345a-4453-b184-45305f6d9a54" Name="Allow files in the folder %systemdrive%\Windows\Installer." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\Installer\*" /> </Conditions> </FilePathRule> <FilePathRule Id="64ad46ff-0d71-4fa0-a30b-3f3d30c5433d" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameMSI -Property @{ParentID=$parentID;InstanceID="MSI";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Script" EnforcementMode="Enabled"> <FilePathRule Id="06dce67b-934c-454f-a263-2515c8796a5d" Name="Allow scripts in Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePathRule Id="9428c672-5fc3-47f4-808a-a0011f36dd2c" Name="Allow scripts in Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\debug\wia\*" /> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%SYSTEM32%\com\dmp\*" /> <FilePathCondition Path="%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\*" /> <FilePathCondition Path="%SYSTEM32%\drivers\driverdata\*" /> <FilePathCondition Path="%SYSTEM32%\fxstmp\*" /> <FilePathCondition Path="%SYSTEM32%\microsoft\crypto\rsa\machinekeys\*" /> <FilePathCondition Path="%SYSTEM32%\spool\drivers\color\*" /> <FilePathCondition Path="%SYSTEM32%\spool\printers\*" /> <FilePathCondition Path="%SYSTEM32%\spool\servers\*" /> <FilePathCondition Path="%SYSTEM32%\tasks\*" /> <FilePathCondition Path="%SYSTEM32%\tasks_migrated\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="ed97d0cb-15ff-430f-b82c-8d7832957725" Name="Allow for Administrators" Description="" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameScript -Property @{ParentID=$parentID;InstanceID="Script";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Dll" EnforcementMode="Enabled"> <FilePathRule Id="bac4b0bf-6f1b-40e8-8627-8545fa89c8b6" Name="Allow DLLs in Windows folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> <Exceptions> <FilePathCondition Path="%WINDIR%\debug\wia\*" /> <FilePathCondition Path="%WINDIR%\registration\crmlog\*" /> <FilePathCondition Path="%SYSTEM32%\com\dmp\*" /> <FilePathCondition Path="%SYSTEM32%\config\systemprofile\appdata\local\packages\wdagrdpclientappcontainer\ac\*" /> <FilePathCondition Path="%SYSTEM32%\drivers\driverdata\*" /> <FilePathCondition Path="%SYSTEM32%\fxstmp\*" /> <FilePathCondition Path="%SYSTEM32%\microsoft\crypto\rsa\machinekeys\*" /> <FilePathCondition Path="%SYSTEM32%\spool\drivers\color\*" /> <FilePathCondition Path="%SYSTEM32%\spool\printers\*" /> <FilePathCondition Path="%SYSTEM32%\spool\servers\*" /> <FilePathCondition Path="%SYSTEM32%\tasks\*" /> <FilePathCondition Path="%SYSTEM32%\tasks_migrated\*" /> <FilePathCondition Path="%WINDIR%\tasks\*" /> <FilePathCondition Path="%WINDIR%\temp\*" /> <FilePathCondition Path="%WINDIR%\tracing\*" /> </Exceptions> </FilePathRule> <FilePathRule Id="3737732c-99b7-41d4-9037-9cddfb0de0d0" Name="Allow DLLs in Program Files folder" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <FilePublisherRule Id="1f0d0ec5-8523-4aa0-976a-ad2d2c21eed7" Name="Allow all Signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameDLL -Property @{ParentID=$parentID;InstanceID="DLL";Policy=$obj} $obj = [System.Net.WebUtility]::HtmlEncode(@" <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="All signed" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> "@) New-CimInstance -Namespace $namespaceName -ClassName $classNameStoreApps -Property @{ParentID=$parentID;InstanceID="Storeapps";Policy=$obj} [/CODE] [B][COLOR=rgb(184, 49, 47)]Warning!!! I strongly recommend making a System Restore Point before applying the Applocker rules.[/COLOR][/B] [/QUOTE]

Verification