Application Whitelisting Theory
The native Microsoft whitelisting implementation
leverages a kernel-mode filter driver
and various native kernel APIs.
Specifically, the Microsoft kernel-mode
PsSetCreateProcessNotify- RoutineEx API
registers a notification callback which allows the
execution of a provided kernel-mode function
every time a new process is created.
Application whitelisting software uses a custom driver
to register a callback function through this API.
This callback is then invoked every time a new process is
created and it allows the whitelisting software to
determine whether or not the application is whitelisted.
If the software determines that the application is allowed,
process creation completes and the code will execute.
On the other hand, if the application is not allowed,
the process is terminated, and an error message may be displayed.
As the name suggests, whitelisting software will block
everything except applications specifically listed
in a configurable ruleset.
Microsoft provides multiple native application
whitelisting solutions.
Prior to Windows 7, Microsoft introduced the
Software Restriction Policies (SRP) whitelisting solution.
It is still available but has been superseded by AppLocker,
which was introduced with Windows 7
and is still available in current versions of Windows 10.
AppLocker components include the kernel-mode driver APPID.SYS
and the APPIDSVC user-mode service.
APPIDSVC manages the whitelisting ruleset
and identifies applications when they are run
based on the callback notifications from APPID.SYS.
Microsoft released a new type of application whitelisting
solution with Windows 10, which is enforced from the HyperVisor,
subsequently operating at a deeper level
than kernel-mode solutions.
Originally introduced as Device Guard, it was recently rebranded
as Windows Defender Application Control, which performs
whitelisting actions in both user-mode and kernel-mode.
Now that we’ve briefly discussed the basic application
whitelisting software theory, we’ll begin configuring
whitelisting rules for AppLocker,
one of the more commonly-deployed solutions.
Note that AppLocker is only available on Enterprise
and Ultimate editions of Windows,
which excludes Windows Professional and other versions.