<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-application-whitelisting
description: >-
  Deploy and manage application whitelisting using AppLocker, WDAC, and
  Linux fapolicyd. Covers policy creation, rule types, enforcement modes,
  bypass monitoring, and operational maintenance workflows.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - applocker
  - wdac
  - application-control
  - fapolicyd
  - software-restriction
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1218
    - T1059
    - T1204
    - T1036
---

# Implementing Application Whitelisting

## Overview

Application whitelisting is one of the most effective controls against
unauthorized code execution. AppLocker and Windows Defender Application Control
(WDAC) enforce allow-lists on Windows; fapolicyd provides equivalent control on
Linux. Effective deployment requires staged rollout from audit to enforcement mode.

## Prerequisites

| Requirement | Purpose |
|---|---|
| AppLocker | Windows Enterprise/Education editions with AppIDSvc |
| WDAC | Windows 10/11 Enterprise or Server 2016+ |
| fapolicyd | RHEL/Fedora file access policy daemon |
| Group Policy | GPO management for AppLocker policy distribution |

## Workflow

1. **Inventory applications** — Catalog all legitimate software using AppLocker wizard
2. **Create baseline policy** — Default rules + publisher rules for trusted vendors
3. **Deploy in audit mode** — Monitor EID 8003/8006 for would-be blocks
4. **Analyze audit logs** — Identify legitimate applications needing rules
5. **Add exception rules** — Publisher, path, or hash rules for approved software
6. **Enable enforcement** — Switch from Audit Only to Enforce after burn-in
7. **Monitor bypass attempts** — Alert on EID 8004 (block) and known bypass LOLBins
8. **Maintain policy** — Update rules for new software deployments

## Key Commands

```powershell
# AppLocker — Export current policy
Get-AppLockerPolicy -Effective -Xml | Out-File applocker-policy.xml

# AppLocker — Create default rules
Set-AppLockerPolicy -XmlPolicy default-rules.xml -Merge

# AppLocker — Check enforcement mode
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# WDAC — Create policy from reference system
New-CIPolicy -FilePath policy.xml -Level Publisher -Fallback Hash -ScanPath C:\

# WDAC — Convert to binary
ConvertFrom-CIPolicy policy.xml policy.bin

# WDAC — Deploy policy
Copy-Item policy.bin C:\Windows\System32\CodeIntegrity\SIPolicy.p7b

# Linux fapolicyd — Install and configure
dnf install fapolicyd
systemctl enable --now fapolicyd
fapolicyd-cli --update

# Monitor AppLocker events
Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" -MaxEvents 50
```

## Verification

| Check | Method |
|---|---|
| AppIDSvc running | `sc query AppIDSvc` returns RUNNING |
| Policy applied | `Get-AppLockerPolicy -Effective` shows rules |
| Audit events present | EID 8003 events logged for test binary |
| Enforcement active | Unsigned binary blocked with EID 8004 |
| WDAC policy loaded | `Get-CimInstance -ClassName Win32_DeviceGuard` shows policy active |

## References

- [AppLocker Documentation](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/)
- [WDAC Deployment Guide](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/)
- [fapolicyd Documentation](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/assembly_blocking-and-allowing-applications-using-fapolicyd_security-hardening)

---
v1.0 | Validated: 2026-03-18
