Getting Started With AppLocker

This blog post demonstrates how an attacker can weaponize a simple backdoor (using the ADHD toolkit to deliver a Meterpreter payload) on a default Windows 10 system, and then walks through configuring Windows AppLocker (creating default rules, starting the Application Identity service, and testing with a standard user) to implement directory-based application whitelisting that can block the majority of drive-by attacks.