AppLocker

百度 ”薛峰认为，随着智能预报技术的发展，现有的气象预报员工作内容会发生一定变化，一部分专注于大气运动机理的分析理解认识，并做重要的订正预报，更多关注“影响预报”，即当前的天气对相关领域和行业有什么后续影响；而另一些预报员可能会关注人工智能技术本身，即如何更好地将人工智能技术与气象预报服务行业结合，进一步提高准确率，或研发更符合社会需求的预报服务产品。

AppLocker is an application whitelisting technology introduced with Microsoft's Windows 7 operating system. It allows restricting which programs users can execute based on the program's path, publisher, or hash,^[1] and in an enterprise can be configured via Group Policy.

Summary

Windows AppLocker allows administrators to control which executable files are denied or allowed to execute. With AppLocker, administrators are able to create rules based on file names, publishers or file location that will allow certain files to execute. Unlike the earlier Software Restriction Policies, which was originally available for Windows XP and Windows Server 2003,^[2] AppLocker rules can apply to individuals or groups. Policies are used to group users into different enforcement levels. For example, some users can be added to an 'audit' policy that will allow administrators to see the rule violations before moving that user to a higher enforcement level.

AppLocker availability charts

AppLocker availability on Windows 7^[3]
Starter	Home Basic	Home Premium	Professional	Enterprise	Ultimate
No	No	No	Create policies, but cannot enforce	Create and enforce policies	Create and enforce policies

AppLocker availability on Windows 8^[4]
RT	(Core)	Pro	Enterprise
No	No	No	Yes

AppLocker availability on Windows 10^[5]^[6]^[7]
Home	Pro	Enterprise	Education
Yes	Yes	Yes	Yes

Bypass techniques

There are several generic techniques for bypassing AppLocker:

Writing an unapproved program to a whitelisted location.
Using a whitelisted program as a delegate to launch an unapproved program.^[8]^[9]^[10]^[11]
Hijacking the DLLs loaded by a trusted application in an untrusted directory.^[12]

References

^ "AppLocker". Microsoft TechNet. Microsoft. Retrieved 23 August 2012.
^ "Using Software Restriction Policies to Protect Against Unauthorized Software". Microsoft TechNet. Microsoft. 11 September 2009. Retrieved 27 July 2017.
^ "Windows Versions That Support AppLocker". Microsoft. 17 November 2009. Retrieved 27 July 2017.
^ Visser, Erwin (18 April 2012). "Introducing Windows 8 Enterprise and Enhanced Software Assurance for Today's Modern Workforce". Windows for your Business. Microsoft. Archived from the original on 25 December 2012. Retrieved 22 November 2012.
^ Dudau, Vlad (10 June 2015). "Microsoft shows OEMs how to market Windows 10; talks features and SKUs". Neowin. Neowin LLC. Retrieved 19 June 2015.
^ "Find out which Windows is right for you". Microsoft. Microsoft Inc. Retrieved 2 July 2015.
^ "Removal of Windows edition checks for AppLocker". Microsoft. Microsoft Inc. Retrieved 22 February 2023.
^ "AppLocker Bypass – InstallUtil". Penetration Testing Lab. 8 May 2017. Retrieved 27 July 2017.
^ "AppLocker Bypass Techniques". Evi1cg's blog. 12 September 2016. Retrieved 27 July 2017.
^ "How to Bypass Windows AppLocker". Hacking Tutorial. 19 April 2017. Retrieved 27 July 2017.
^ "caseysmithrc/gethelp.cs". Github Gist. Archived from the original on 14 May 2019. Retrieved 14 May 2019.
^ "Bypassing Application Whitelisting". CERT/CC Blog. 29 June 2016. Retrieved 27 July 2017.

[1] "AppLocker". Microsoft TechNet. Microsoft. Retrieved 23 August 2012.

[2] "Using Software Restriction Policies to Protect Against Unauthorized Software". Microsoft TechNet. Microsoft. 11 September 2009. Retrieved 27 July 2017.

[3] "Windows Versions That Support AppLocker". Microsoft. 17 November 2009. Retrieved 27 July 2017.

[WFYB-2012-4] Visser, Erwin (18 April 2012). "Introducing Windows 8 Enterprise and Enhanced Software Assurance for Today's Modern Workforce". Windows for your Business. Microsoft. Archived from the original on 25 December 2012. Retrieved 22 November 2012.

[neowinoem-5] Dudau, Vlad (10 June 2015). "Microsoft shows OEMs how to market Windows 10; talks features and SKUs". Neowin. Neowin LLC. Retrieved 19 June 2015.

[winforbusiness-6] "Find out which Windows is right for you". Microsoft. Microsoft Inc. Retrieved 2 July 2015.

[KB5024351-7] "Removal of Windows edition checks for AppLocker". Microsoft. Microsoft Inc. Retrieved 22 February 2023.

[8] "AppLocker Bypass – InstallUtil". Penetration Testing Lab. 8 May 2017. Retrieved 27 July 2017.

[9] "AppLocker Bypass Techniques". Evi1cg's blog. 12 September 2016. Retrieved 27 July 2017.

[10] "How to Bypass Windows AppLocker". Hacking Tutorial. 19 April 2017. Retrieved 27 July 2017.

[11] "caseysmithrc/gethelp.cs". Github Gist. Archived from the original on 14 May 2019. Retrieved 14 May 2019.

[12] "Bypassing Application Whitelisting". CERT/CC Blog. 29 June 2016. Retrieved 27 July 2017.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

rh是什么单位	拉稀吃什么食物好	慢性胃炎是什么原因引起的	什么是公元前和公元后	呼风唤雨的动物是什么生肖
梦见家里死人了代表什么预兆	什么是磁共振检查	组织委员的职责是什么	为什么右眼皮一直跳	北戴河在什么地方
50肩是什么意思	釜底抽薪是什么计	一个马一个襄念什么	胆汁反流用什么药好	强碱是什么
cap医学上是什么意思	o2o模式是什么意思	四氯化碳是什么	左眼跳是什么预兆	膝盖窝疼是什么原因

盔甲是什么意思hcv8jop5ns2r.cn	hibor是什么意思hcv8jop2ns9r.cn	什么食物降胆固醇最好hcv8jop5ns2r.cn	阿q精神是什么意思hcv9jop3ns0r.cn	手脚发热什么原因hcv8jop6ns2r.cn
为什么老是想吐yanzhenzixun.com	经常呕吐是什么原因sscsqa.com	吃什么食物对心脏好hcv8jop3ns5r.cn	杺是什么意思hcv8jop8ns4r.cn	nb是什么意思zsyouku.com
小米粥和什么搭配最好hcv8jop6ns4r.cn	喝羊奶有什么好处hcv8jop5ns1r.cn	单侧耳鸣是什么原因引起的hcv8jop7ns4r.cn	颈椎退行性变是什么意思hcv7jop6ns9r.cn	解肌是什么意思hcv8jop6ns6r.cn
谣言是什么意思hcv9jop0ns9r.cn	做梦梦到鸡是什么意思hcv9jop0ns4r.cn	多多益善的意思是什么hcv8jop5ns7r.cn	大米粉做什么好吃hcv8jop8ns5r.cn	身上长红痘痘是什么原因hcv8jop4ns2r.cn