Application whitelisting

[Gaz]

So this is something I should be doing but I'm not.

 

Its about time I set it up but I was wondering how it works exactly. I know it will work on a list of applications I specify such as word.exe ie.exe etc etc but what about all the applications that windows uses to work surely I don't have to whitelist everything such as csrss.exe explorer.exe svchost.exe etc etc. Also for software which uses multiple executables when running do I have to allow each one?

 

Sorry for the silly questions, does anyone have a dummies guide for setting it up too, we have a vanilla windows network with 2008 R2 and 2012 R2 servers Windows 7 Pro and Ent desktops.

[mavhc]

I did this, basically a GPO that only allows executables from places I can write to, not from where users can write to. Does break a few things like drivers that download applications that uncompress to temp, but surprisingly very few problems.

 

Software Restriction Policies

Enforcement

Policy Setting

Apply Software Restriction Policies to the following All software files except libraries (such as DLLs)

Apply Software Restriction Policies to the following users All users

When applying Software Restriction Policies Ignore certificate rules

 

Software Restriction Policies/Security Levels

Policy Setting

Default Security Level Disallowed

 

Path Rules

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%

Security Level Unrestricted

Description

Date last modified 08/10/2015 15:03:30

 

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%

Security Level Unrestricted

Description

Date last modified 26/11/2015 13:08:50

 

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%

Security Level Unrestricted

Description

Date last modified 08/10/2015 15:03:30

 

\\domain.local\dm\Resources\*

Security Level Unrestricted

Description

Date last modified 26/11/2015 13:18:41

 

\\domain.local\share$\SoftwareInstall\*

Security Level Unrestricted

Description

Date last modified 26/11/2015 13:18:47

 

\\domain.local\sysvol\*

Security Level Unrestricted

 

c:\python*

Security Level Unrestricted

[Gaz]

How are you applying that policy? To groups of users or computers? I'd also want to restrict executables from pen drives however we do have some encrypted drives that has an executable that runs the decryption program, could I disallow executables from usb drives but allow the decryption executable to run on the drive?

[mavhc]

You can whitelist specific files to run from anywhere with a hash rule. I'm applying it to computers.

 

Turns out I've missed a few folders users can write to, https://mssec.wordpress.com/2015/10/22/applocker-bypass-checker/

 

C:\Windows\debug\WIA\ABCtestfile.exe

C:\Windows\Registration\CRMLog\ABCtestfile.exe

C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ABCtestf...

C:\Windows\System32\FxsTmp\ABCtestfile.exe

C:\Windows\System32\spool\drivers\color\ABCtestfile.exe

C:\Windows\SysWOW64\FxsTmp\ABCtestfile.exe

C:\Windows\Tasks\ABCtestfile.exe

C:\Windows\tracing\ABCtestfile.exe

C:\Windows\tracing\PowerTracker\ABCtestfile.exe

 

Fun times.

[ITGuyWestMidlands]

Careful with that python rule. You will find most users can write there by default.

[mavhc]

Not with my default python 3.4 msi install.

 

Anyway, quite easy to test now, set up a test OU, apply SRP, run that checker.

[colacao82]

Hoping someone here can help me...

 

So I'm trying to set up and application whitelist using SRP and I can't get Softlink Alice to run even though i've allowed the UNC path to the .exe and even added a hash for it. I've successfully whitelisted other apps on UNC paths but can't get Alice to work. it will launch the initial loading screen but then nothing. I'm wondering if it calls a script/file on the users PC during launch that is blocked.

 

Thanks

[Chuckster]

@colacao82, when launching the .exe does it create other files in the %temp% folder which references to other .exe's? If so, you may need to whitelist them, too.

[stickman]

Hoping someone here can help me...

 

So I'm trying to set up and application whitelist using SRP and I can't get Softlink Alice to run even though i've allowed the UNC path to the .exe and even added a hash for it. I've successfully whitelisted other apps on UNC paths but can't get Alice to work. it will launch the initial loading screen but then nothing. I'm wondering if it calls a script/file on the users PC during launch that is blocked.

 

Thanks

 

Check eventvwr for EventID 865/866 as mentioned in this post: https://community.spiceworks.com/how_to/57422-deploying-a-whitelist-software-restriction-policy-to-prevent-cryptolocker-and-more

[mavhc]

And don't forget to file a bug with the company about it

[mavhc]

Few weeks later: 2 issues I've found

 

Sophos Auto Update unpacks to temp, had to add a hash rule for AVRemove.exe AVRemoveW.exe and Sophos Auto Update.msi

 

Of course those will change over time.

 

Second problem is SIMS of course.

 

Does SOLUS 3 fix unpacking the to temp issue?