AppLocker

AppLocker can be used on Windows machines to control the execution of executables, dlls, scripts, and more. Here, we very often speak about whitelisting rules (specifically defining what can be executed) and blacklisting rules (preventing only specific known executions). AppLocker itself provides Allow and Deny rules, which fit perfectly with the previously described whitelisting and blacklisting rules.

To now force the whitelisting of our scripts, the following possibilities are available:

We create a simple script rule, configured in Allow-Mode, and are provided with three choices:

• Publisher: Sign all your scripts with a certificate from a trusted publisher to allow the execution of signed scripts
• Path: Use specific paths for whitelisting
• File hash: Pick dedicated scripts that are allowed to run

As a recommendation, you can start off very simple with path rules. Always use the GUI to create the paths to not make any mistakes. An initial approach could result in having a folder called...