> For the complete documentation index, see [llms.txt](https://akuma-s.gitbook.io/akuma/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://akuma-s.gitbook.io/akuma/hardening/windows-security-controls/applocker-basics.md).

# Applocker Basics

<mark style="color:green;">Practical LAB : HTB(Hathor)</mark>

<mark style="color:green;">If you want to create Applocker rule</mark>

{% embed url="<https://www.youtube.com/watch?v=qAoM6iJEVbY&t=595s&ab_channel=ThioJoe>" %}

&#x20;In summary the following are allowed to run:

* Appx - Only signed
* Dll
  * Signed by Microsoft
  * In Program Files and Windows folders
  * Run by admin group
  * `C:\share\scripts\7-zip64.dll` or `C:\Get-bADpasswords\PSI\Psi_x64.dll`
* Exe
  * Explicitly blocks known AppLocker bypasses even signed by Microsoft, including `MSDT.exe`, `PRESENTATIONHOST.exe`, `MSHTA.exe`, `MSBUILD.exe`, `INSTALLUTIL.exe`
  * Allow Signed by `administrator@windcorp.com`, AutoIt, or Microsoft (if not in above)
  * Explicitly blocks known paths, like `%SYSTEM#2%\Tasks:*`, `%SYSTEM32%\regvr32`, `%SYSTEM32%\spool\drivers\color:*`, etc.
  * In Program Files and Windows folders
  * Run by admin group
  * `C:\share\Bginfo64.exe`.
* Msi
  * Signed
  * In `C:\Windows\Installer`
  * Run by admin group
* Scripts
  * Signed by <administrator@windcorp.htb>
  * In Program Files and Windows folders
  * Run by admin group
  * `C:\script\login.cmd`