[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EV096E80CMGWMDC64SE3RG":3,"skill-same:01M6EV096E80CMGWMDC64SE3RG":123},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":66,"commitSha":67,"skillDirectory":68,"forksCount":14,"repositoryHtmlUrl":69,"repositoryHomepageUrl":70,"ownerHtmlUrl":71,"ownerBlogUrl":6,"ownerDescription":72,"updatedAt":73,"install":74,"resources":87},"01M6EV096E80CMGWMDC64SE3RG","implementing-application-whitelisting-with-applocker",null,"Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT. Use when enforcing application control policies, meeting compliance requirements for software restriction, or preventing execution of unsigned or untrusted binaries. Activates for requests involving AppLocker, application whitelisting, software restriction, or executable control.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"with","application","implementing application whitelisting with applocker","AppLocker","t1059","de","software","requirements","cm","use","security","execution","Tools","windows-security","endpoint","endpoint-security","malware","pr","windows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-application-whitelisting-with-applocker\ndescription: 'Implements application whitelisting using Windows AppLocker to restrict\n  unauthorized software execution on endpoints, reducing attack surface from malware,\n  unauthorized tools, and shadow IT. Use when enforcing application control policies,\n  meeting compliance requirements for software restriction, or preventing execution\n  of unsigned or untrusted binaries. Activates for requests involving AppLocker, application\n  whitelisting, software restriction, or executable control.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- AppLocker\n- application-whitelisting\n- windows-security\n- software-restriction\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n- T1027\n---\n# Implementing Application Whitelisting with AppLocker\n\n## When to Use\n\nUse this skill when:\n- Implementing application control to prevent unauthorized software execution on Windows endpoints\n- Meeting compliance requirements (PCI DSS 6.4.3, NIST 800-53 CM-7, ACSC Essential Eight)\n- Blocking common attack vectors: living-off-the-land binaries (LOLBins), script-based attacks, unauthorized admin tools\n- Restricting software installation in kiosk, POS, or high-security environments\n\n**Do not use** this skill for macOS\u002FLinux application control (use OS-native tools like Gatekeeper or AppArmor) or for enterprise-grade WDAC (Windows Defender Application Control) deployments.\n\n## Prerequisites\n\n- Windows 10\u002F11 Enterprise or Education, or Windows Server 2016+\n- Application Identity service (AppIDSvc) enabled on target endpoints\n- Active Directory with Group Policy Management Console (GPMC)\n- Complete application inventory of approved software\n- Test OU with representative endpoints for policy validation\n\n## Workflow\n\n### Step 1: Inventory Approved Applications\n\nBefore creating AppLocker rules, catalog all legitimate software:\n\n```powershell\n# Generate application inventory on reference endpoint\nGet-AppLockerFileInformation -Directory \"C:\\Program Files\" -Recurse `\n  -FileType Exe | Export-Csv \"C:\\AppLocker\\app_inventory_progfiles.csv\" -NoTypeInformation\n\nGet-AppLockerFileInformation -Directory \"C:\\Program Files (x86)\" -Recurse `\n  -FileType Exe | Export-Csv \"C:\\AppLocker\\app_inventory_progfiles86.csv\" -NoTypeInformation\n\n# Include Windows system executables\nGet-AppLockerFileInformation -Directory \"C:\\Windows\" -Recurse `\n  -FileType Exe | Export-Csv \"C:\\AppLocker\\app_inventory_windows.csv\" -NoTypeInformation\n```\n\n### Step 2: Create AppLocker Policy with Default Rules\n\n```powershell\n# In Group Policy Editor (gpedit.msc) or GPMC:\n# Navigate to: Computer Configuration → Policies → Windows Settings\n#   → Security Settings → Application Control Policies → AppLocker\n\n# Enable default rules for each rule collection:\n# - Executable Rules: Allow Everyone to run files in Program Files and Windows\n# - Windows Installer Rules: Allow Everyone to run digitally signed MSIs\n# - Script Rules: Allow Everyone to run scripts in Program Files and Windows\n# - Packaged App Rules: Allow Everyone to run signed packaged apps\n\n# PowerShell: Generate default rules\n$defaultRules = Get-AppLockerPolicy -Local -Xml\nSet-AppLockerPolicy -XmlPolicy $defaultRules -Merge\n```\n\n### Step 3: Create Publisher-Based Rules (Preferred)\n\nPublisher rules are the most maintainable since they survive application updates:\n\n```xml\n\u003C!-- Example AppLocker policy XML for publisher rules -->\n\u003CRuleCollection Type=\"Exe\" EnforcementMode=\"AuditOnly\">\n  \u003C!-- Default: Allow Windows binaries -->\n  \u003CFilePublisherRule Id=\"a9e18c21-ff54-4677-b3ac-4b9a03261f6c\"\n    Name=\"Allow Microsoft signed\" Description=\"Allow all Microsoft-signed executables\"\n    UserOrGroupSid=\"S-1-1-0\" Action=\"Allow\">\n    \u003CConditions>\n      \u003CFilePublisherCondition PublisherName=\"O=MICROSOFT CORPORATION*\"\n        ProductName=\"*\" BinaryName=\"*\">\n        \u003CBinaryVersionRange LowSection=\"*\" HighSection=\"*\"\u002F>\n      \u003C\u002FFilePublisherCondition>\n    \u003C\u002FConditions>\n  \u003C\u002FFilePublisherRule>\n\n  \u003C!-- Allow specific third-party vendor -->\n  \u003CFilePublisherRule Id=\"b2e28c32-aa65-5788-c4bd-5c0b14372e7d\"\n    Name=\"Allow Adobe Acrobat\" Description=\"Allow Adobe-signed Acrobat executables\"\n    UserOrGroupSid=\"S-1-1-0\" Action=\"Allow\">\n    \u003CConditions>\n      \u003CFilePublisherCondition PublisherName=\"O=ADOBE INC.*\"\n        ProductName=\"ADOBE ACROBAT*\" BinaryName=\"*\">\n        \u003CBinaryVersionRange LowSection=\"*\" HighSection=\"*\"\u002F>\n      \u003C\u002FFilePublisherCondition>\n    \u003C\u002FConditions>\n  \u003C\u002FFilePublisherRule>\n\u003C\u002FRuleCollection>\n```\n\n### Step 4: Block Known-Abused Binaries (LOLBins)\n\n```powershell\n# Deny rules for commonly abused living-off-the-land binaries\n# These are legitimate Windows tools frequently used by attackers\n\n$denyPaths = @(\n    \"%SYSTEM32%\\mshta.exe\",\n    \"%SYSTEM32%\\wscript.exe\",\n    \"%SYSTEM32%\\cscript.exe\",\n    \"%SYSTEM32%\\regsvr32.exe\",\n    \"%SYSTEM32%\\certutil.exe\",\n    \"%SYSTEM32%\\msbuild.exe\",\n    \"%SYSTEM32%\\installutil.exe\",\n    \"%WINDIR%\\Microsoft.NET\\Framework\\*\\msbuild.exe\",\n    \"%WINDIR%\\Microsoft.NET\\Framework64\\*\\msbuild.exe\"\n)\n\n# Create deny rules in AppLocker policy for standard users\n# Important: Deny rules take precedence over Allow rules\n# Apply only to standard users (not admins who may need these tools)\n```\n\n### Step 5: Configure Script Rules\n\n```\nScript Rules (critical for preventing script-based attacks):\n\nAllow:\n  - Scripts in C:\\Program Files\\* (publisher or path-based)\n  - Scripts in C:\\Windows\\* (default Windows scripts)\n  - Approved admin scripts from \\\\fileserver\\scripts\\*\n\nDeny (for standard users):\n  - PowerShell scripts from user-writable directories\n  - VBScript from %TEMP%, %APPDATA%, %USERPROFILE%\\Downloads\n  - JavaScript (.js) from any user-writable location\n\nDLL Rules (optional, high performance impact):\n  - Enable only in high-security environments\n  - Allow signed DLLs from Program Files and Windows directories\n  - Performance impact: 5-10% CPU increase during DLL loading\n```\n\n### Step 6: Deploy in Audit Mode First\n\n```powershell\n# CRITICAL: Always deploy AppLocker in Audit mode before Enforce mode\n# Audit mode logs what would be blocked without actually blocking\n\n# Set enforcement mode to Audit Only in GPO:\n# AppLocker → Executable Rules → Properties → Configured: Audit only\n# AppLocker → Script Rules → Properties → Configured: Audit only\n# AppLocker → Windows Installer Rules → Properties → Configured: Audit only\n\n# Ensure Application Identity service is running\nSet-Service -Name AppIDSvc -StartupType Automatic\nStart-Service AppIDSvc\n\n# Link GPO to test OU\nNew-GPLink -Name \"AppLocker-Audit-Policy\" `\n  -Target \"OU=AppLocker-Pilot,DC=corp,DC=example,DC=com\"\n\n# Monitor audit logs for 2-4 weeks\n# Event Log: Applications and Services Logs → Microsoft → Windows → AppLocker\n# Event IDs:\n#   8003 = EXE\u002FDLL would be blocked\n#   8006 = Script\u002FMSI would be blocked\n#   8023 = Packaged app would be blocked\n```\n\n### Step 7: Analyze Audit Logs and Refine Rules\n\n```powershell\n# Export AppLocker audit events\nGet-WinEvent -LogName \"Microsoft-Windows-AppLocker\u002FEXE and DLL\" `\n  -FilterXPath \"*[System[EventID=8003]]\" |\n  Select-Object TimeCreated,\n    @{N='User';E={$_.Properties[0].Value}},\n    @{N='FilePath';E={$_.Properties[1].Value}},\n    @{N='FileHash';E={$_.Properties[4].Value}} |\n  Export-Csv \"C:\\AppLocker\\audit_blocked_exes.csv\" -NoTypeInformation\n\n# Review blocked applications\n# For each blocked legitimate application:\n#   1. Create a publisher rule (if signed) or path rule (if unsigned)\n#   2. Add to AppLocker policy\n#   3. Re-audit for 1 additional week\n```\n\n### Step 8: Switch to Enforce Mode\n\n```powershell\n# After audit period with no legitimate applications blocked:\n# Change enforcement mode from Audit to Enforce\n\n# Update GPO:\n# AppLocker → Executable Rules → Properties → Configured: Enforce rules\n# AppLocker → Script Rules → Properties → Configured: Enforce rules\n\n# Phased enforcement:\n# Week 1: Enforce EXE rules only\n# Week 2: Enforce Script rules\n# Week 3: Enforce MSI rules\n# Week 4: (Optional) Enforce DLL rules\n\n# Maintain monitoring: Event IDs 8004 (blocked EXE), 8007 (blocked script)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Application Whitelisting** | Security model that allows only pre-approved applications to execute, denying everything else by default |\n| **Publisher Rule** | AppLocker rule based on digital signature; most resilient to application updates |\n| **Path Rule** | AppLocker rule based on file system path; less secure as attackers can place files in allowed paths |\n| **Hash Rule** | AppLocker rule based on file hash; most restrictive but breaks on every application update |\n| **LOLBin** | Living Off the Land Binary; legitimate OS tool abused by attackers to avoid detection |\n| **Audit Mode** | AppLocker logs policy violations without blocking; essential for rule refinement |\n| **Enforcement Mode** | AppLocker actively blocks applications that violate policy rules |\n\n## Tools & Systems\n\n- **AppLocker (built-in)**: Windows application control feature in Enterprise\u002FEducation editions\n- **WDAC (Windows Defender Application Control)**: More advanced successor to AppLocker for modern Windows\n- **Microsoft LAPS**: Manages local admin passwords to prevent bypassing AppLocker via admin rights\n- **WDAC Wizard**: GUI tool for creating Windows Defender Application Control policies\n- **AaronLocker**: Open-source AppLocker rule generator by Microsoft employee (GitHub)\n\n## Common Pitfalls\n\n- **Skipping Audit mode**: Deploying AppLocker in Enforce mode without audit period will block critical applications and cause outages.\n- **Relying solely on path rules**: Users with write access to allowed paths (C:\\Windows\\Temp) can bypass path-based rules. Prefer publisher rules.\n- **Not blocking user-writable directories**: The most common gap is allowing execution from %TEMP%, Downloads, or %APPDATA%.\n- **Forgetting Application Identity service**: AppLocker requires the AppIDSvc service running. If it stops, all rules stop enforcing.\n- **Admin bypass**: Local administrators can bypass AppLocker by default. For full enforcement, combine with WDAC which enforces for all users including admins.\n- **DLL rule performance**: Enabling DLL rules creates significant performance overhead. Only enable in high-security environments where the tradeoff is justified.\n","# Implementing Application Whitelisting with AppLocker\n\n## When to Use\n\nUse this skill when:\n- Implementing application control to prevent unauthorized software execution on Windows endpoints\n- Meeting compliance requirements (PCI DSS 6.4.3, NIST 800-53 CM-7, ACSC Essential Eight)\n- Blocking common attack vectors: living-off-the-land binaries (LOLBins), script-based attacks, unauthorized admin tools\n- Restricting software installation in kiosk, POS, or high-security environments\n\n**Do not use** this skill for macOS\u002FLinux application control (use OS-native tools like Gatekeeper or AppArmor) or for enterprise-grade WDAC (Windows Defender Application Control) deployments.\n\n## Prerequisites\n\n- Windows 10\u002F11 Enterprise or Education, or Windows Server 2016+\n- Application Identity service (AppIDSvc) enabled on target endpoints\n- Active Directory with Group Policy Management Console (GPMC)\n- Complete application inventory of approved software\n- Test OU with representative endpoints for policy validation\n\n## Workflow\n\n### Step 1: Inventory Approved Applications\n\nBefore creating AppLocker rules, catalog all legitimate software:\n\n```powershell\n# Generate application inventory on reference endpoint\nGet-AppLockerFileInformation -Directory \"C:\\Program Files\" -Recurse `\n  -FileType Exe | Export-Csv \"C:\\AppLocker\\app_inventory_progfiles.csv\" -NoTypeInformation\n\nGet-AppLockerFileInformation -Directory \"C:\\Program Files (x86)\" -Recurse `\n  -FileType Exe | Export-Csv \"C:\\AppLocker\\app_inventory_progfiles86.csv\" -NoTypeInformation\n\n# Include Windows system executables\nGet-AppLockerFileInformation -Directory \"C:\\Windows\" -Recurse `\n  -FileType Exe | Export-Csv \"C:\\AppLocker\\app_inventory_windows.csv\" -NoTypeInformation\n```\n\n### Step 2: Create AppLocker Policy with Default Rules\n\n```powershell\n# In Group Policy Editor (gpedit.msc) or GPMC:\n# Navigate to: Computer Configuration → Policies → Windows Settings\n#   → Security Settings → Application Control Policies → AppLocker\n\n# Enable default rules for each rule collection:\n# - Executable Rules: Allow Everyone to run files in Program Files and Windows\n# - Windows Installer Rules: Allow Everyone to run digitally signed MSIs\n# - Script Rules: Allow Everyone to run scripts in Program Files and Windows\n# - Packaged App Rules: Allow Everyone to run signed packaged apps\n\n# PowerShell: Generate default rules\n$defaultRules = Get-AppLockerPolicy -Local -Xml\nSet-AppLockerPolicy -XmlPolicy $defaultRules -Merge\n```\n\n### Step 3: Create Publisher-Based Rules (Preferred)\n\nPublisher rules are the most maintainable since they survive application updates:\n\n```xml\n\u003C!-- Example AppLocker policy XML for publisher rules -->\n\u003CRuleCollection Type=\"Exe\" EnforcementMode=\"AuditOnly\">\n  \u003C!-- Default: Allow Windows binaries -->\n  \u003CFilePublisherRule Id=\"a9e18c21-ff54-4677-b3ac-4b9a03261f6c\"\n    Name=\"Allow Microsoft signed\" Description=\"Allow all Microsoft-signed executables\"\n    UserOrGroupSid=\"S-1-1-0\" Action=\"Allow\">\n    \u003CConditions>\n      \u003CFilePublisherCondition PublisherName=\"O=MICROSOFT CORPORATION*\"\n        ProductName=\"*\" BinaryName=\"*\">\n        \u003CBinaryVersionRange LowSection=\"*\" HighSection=\"*\"\u002F>\n      \u003C\u002FFilePublisherCondition>\n    \u003C\u002FConditions>\n  \u003C\u002FFilePublisherRule>\n\n  \u003C!-- Allow specific third-party vendor -->\n  \u003CFilePublisherRule Id=\"b2e28c32-aa65-5788-c4bd-5c0b14372e7d\"\n    Name=\"Allow Adobe Acrobat\" Description=\"Allow Adobe-signed Acrobat executables\"\n    UserOrGroupSid=\"S-1-1-0\" Action=\"Allow\">\n    \u003CConditions>\n      \u003CFilePublisherCondition PublisherName=\"O=ADOBE INC.*\"\n        ProductName=\"ADOBE ACROBAT*\" BinaryName=\"*\">\n        \u003CBinaryVersionRange LowSection=\"*\" HighSection=\"*\"\u002F>\n      \u003C\u002FFilePublisherCondition>\n    \u003C\u002FConditions>\n  \u003C\u002FFilePublisherRule>\n\u003C\u002FRuleCollection>\n```\n\n### Step 4: Block Known-Abused Binaries (LOLBins)\n\n```powershell\n# Deny rules for commonly abused living-off-the-land binaries\n# These are legitimate Windows tools frequently used by attackers\n\n$denyPaths = @(\n    \"%SYSTEM32%\\mshta.exe\",\n    \"%SYSTEM32%\\wscript.exe\",\n    \"%SYSTEM32%\\cscript.exe\",\n    \"%SYSTEM32%\\regsvr32.exe\",\n    \"%SYSTEM32%\\certutil.exe\",\n    \"%SYSTEM32%\\msbuild.exe\",\n    \"%SYSTEM32%\\installutil.exe\",\n    \"%WINDIR%\\Microsoft.NET\\Framework\\*\\msbuild.exe\",\n    \"%WINDIR%\\Microsoft.NET\\Framework64\\*\\msbuild.exe\"\n)\n\n# Create deny rules in AppLocker policy for standard users\n# Important: Deny rules take precedence over Allow rules\n# Apply only to standard users (not admins who may need these tools)\n```\n\n### Step 5: Configure Script Rules\n\n```\nScript Rules (critical for preventing script-based attacks):\n\nAllow:\n  - Scripts in C:\\Program Files\\* (publisher or path-based)\n  - Scripts in C:\\Windows\\* (default Windows scripts)\n  - Approved admin scripts from \\\\fileserver\\scripts\\*\n\nDeny (for standard users):\n  - PowerShell scripts from user-writable directories\n  - VBScript from %TEMP%, %APPDATA%, %USERPROFILE%\\Downloads\n  - JavaScript (.js) from any user-writable location\n\nDLL Rules (optional, high performance impact):\n  - Enable only in high-security environments\n  - Allow signed DLLs from Program Files and Windows directories\n  - Performance impact: 5-10% CPU increase during DLL loading\n```\n\n### Step 6: Deploy in Audit Mode First\n\n```powershell\n# CRITICAL: Always deploy AppLocker in Audit mode before Enforce mode\n# Audit mode logs what would be blocked without actually blocking\n\n# Set enforcement mode to Audit Only in GPO:\n# AppLocker → Executable Rules → Properties → Configured: Audit only\n# AppLocker → Script Rules → Properties → Configured: Audit only\n# AppLocker → Windows Installer Rules → Properties → Configured: Audit only\n\n# Ensure Application Identity service is running\nSet-Service -Name AppIDSvc -StartupType Automatic\nStart-Service AppIDSvc\n\n# Link GPO to test OU\nNew-GPLink -Name \"AppLocker-Audit-Policy\" `\n  -Target \"OU=AppLocker-Pilot,DC=corp,DC=example,DC=com\"\n\n# Monitor audit logs for 2-4 weeks\n# Event Log: Applications and Services Logs → Microsoft → Windows → AppLocker\n# Event IDs:\n#   8003 = EXE\u002FDLL would be blocked\n#   8006 = Script\u002FMSI would be blocked\n#   8023 = Packaged app would be blocked\n```\n\n### Step 7: Analyze Audit Logs and Refine Rules\n\n```powershell\n# Export AppLocker audit events\nGet-WinEvent -LogName \"Microsoft-Windows-AppLocker\u002FEXE and DLL\" `\n  -FilterXPath \"*[System[EventID=8003]]\" |\n  Select-Object TimeCreated,\n    @{N='User';E={$_.Properties[0].Value}},\n    @{N='FilePath';E={$_.Properties[1].Value}},\n    @{N='FileHash';E={$_.Properties[4].Value}} |\n  Export-Csv \"C:\\AppLocker\\audit_blocked_exes.csv\" -NoTypeInformation\n\n# Review blocked applications\n# For each blocked legitimate application:\n#   1. Create a publisher rule (if signed) or path rule (if unsigned)\n#   2. Add to AppLocker policy\n#   3. Re-audit for 1 additional week\n```\n\n### Step 8: Switch to Enforce Mode\n\n```powershell\n# After audit period with no legitimate applications blocked:\n# Change enforcement mode from Audit to Enforce\n\n# Update GPO:\n# AppLocker → Executable Rules → Properties → Configured: Enforce rules\n# AppLocker → Script Rules → Properties → Configured: Enforce rules\n\n# Phased enforcement:\n# Week 1: Enforce EXE rules only\n# Week 2: Enforce Script rules\n# Week 3: Enforce MSI rules\n# Week 4: (Optional) Enforce DLL rules\n\n# Maintain monitoring: Event IDs 8004 (blocked EXE), 8007 (blocked script)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Application Whitelisting** | Security model that allows only pre-approved applications to execute, denying everything else by default |\n| **Publisher Rule** | AppLocker rule based on digital signature; most resilient to application updates |\n| **Path Rule** | AppLocker rule based on file system path; less secure as attackers can place files in allowed paths |\n| **Hash Rule** | AppLocker rule based on file hash; most restrictive but breaks on every application update |\n| **LOLBin** | Living Off the Land Binary; legitimate OS tool abused by attackers to avoid detection |\n| **Audit Mode** | AppLocker logs policy violations without blocking; essential for rule refinement |\n| **Enforcement Mode** | AppLocker actively blocks applications that violate policy rules |\n\n## Tools & Systems\n\n- **AppLocker (built-in)**: Windows application control feature in Enterprise\u002FEducation editions\n- **WDAC (Windows Defender Application Control)**: More advanced successor to AppLocker for modern Windows\n- **Microsoft LAPS**: Manages local admin passwords to prevent bypassing AppLocker via admin rights\n- **WDAC Wizard**: GUI tool for creating Windows Defender Application Control policies\n- **AaronLocker**: Open-source AppLocker rule generator by Microsoft employee (GitHub)\n\n## Common Pitfalls\n\n- **Skipping Audit mode**: Deploying AppLocker in Enforce mode without audit period will block critical applications and cause outages.\n- **Relying solely on path rules**: Users with write access to allowed paths (C:\\Windows\\Temp) can bypass path-based rules. Prefer publisher rules.\n- **Not blocking user-writable directories**: The most common gap is allowing execution from %TEMP%, Downloads, or %APPDATA%.\n- **Forgetting Application Identity service**: AppLocker requires the AppIDSvc service running. If it stops, all rules stop enforcing.\n- **Admin bypass**: Local administrators can bypass AppLocker by default. For full enforcement, combine with WDAC which enforces for all users including admins.\n- **DLL rule performance**: Enabling DLL rules creates significant performance overhead. Only enable in high-security environments where the tradeoff is justified.\n",{"name":5,"tags":49,"author":52,"domain":43,"license":15,"version":53,"nist_csf":54,"subdomain":39,"description":59,"mitre_attack":60},[38,27,50,37,51],"application-whitelisting","software-restriction","mahipal","1.0.0",[55,56,57,58],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","Implements application whitelisting using Windows AppLocker to restrict unauthorized software execution on endpoints, reducing attack surface from malware, unauthorized tools, and shadow IT. Use when enforcing application control policies, meeting compliance requirements for software restriction, or preventing execution of unsigned or untrusted binaries. Activates for requests involving AppLocker, application whitelisting, software restriction, or executable control.\n",[61,62,63,64,65],"T1055","T1547","T1059","T1036","T1027","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":75,"prompt":85,"zipAvailable":86},[76,79,82],{"tool":77,"command":78},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-application-whitelisting-with-applocker",{"tool":80,"command":81},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-application-whitelisting-with-applocker",{"tool":83,"command":84},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-application-whitelisting-with-applocker","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002FSKILL.md",true,[88,94,99,105,109,113,119],{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"assets\u002Ftemplate.md","ASSET","资产文件",2796,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002Fassets\u002Ftemplate.md",{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002FLICENSE",{"path":100,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":103,"sourceHtmlUrl":104},"references\u002Fapi-reference.md","REFERENCE","参考文档",1586,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002Freferences\u002Fapi-reference.md",{"path":106,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fstandards.md",2882,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002Freferences\u002Fstandards.md",{"path":110,"resourceType":101,"resourceTypeDesc":102,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fworkflows.md",3942,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002Freferences\u002Fworkflows.md",{"path":114,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":117,"sourceHtmlUrl":118},"scripts\u002Fagent.py","SCRIPT","脚本",7318,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002Fscripts\u002Fagent.py",{"path":120,"resourceType":115,"resourceTypeDesc":116,"sizeBytes":121,"sourceHtmlUrl":122},"scripts\u002Fprocess.py",9275,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-application-whitelisting-with-applocker\u002Fscripts\u002Fprocess.py",[124,164,173,182,204,230],{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":145,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[131,134,137,140],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":141,"categoryName":142,"taxonomyType":143,"taxonomyTypeDesc":144},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[126,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,24],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":165,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":172,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[168,169,170,171],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":141,"categoryName":142,"taxonomyType":143,"taxonomyTypeDesc":144},[126,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,24],{"skillNo":174,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":181,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[177,178,179,180],{"categoryNo":132,"categoryName":133,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":135,"categoryName":136,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":138,"categoryName":139,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":141,"categoryName":142,"taxonomyType":143,"taxonomyTypeDesc":144},[126,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,24],{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[189,190,191,192,193,194,195,196,197,198,199,200,201,202,203],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":211,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[210],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,215,216,217,218,219,220,221,222,157,158,223,224,225,226,227,228,229],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":128,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":246,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[236,239,242,243],{"categoryNo":237,"categoryName":238,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":240,"categoryName":241,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":244,"categoryName":245,"taxonomyType":143,"taxonomyTypeDesc":144},"01JBSEEDCAT000000000000036","内容创作者",[247,248,249,250,251,252,253,254,154,255,157,158,159,256,257,31,258,259,203,260],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","formatting","journal","chi"]