applocker 1.1.2

AppLocker Policy parser and emitter for Python

AppLocker

The applocker module allows you to easily parse and create Windows AppLocker Policy XML files and/or strings in Python.

Installation

To install the applocker module via pip, run the command:

$ pip install applocker

Usage

Start by importing the applocker module.

import applocker

The function applocker.load, loads an AppLocker Policy XML file.

with open('example.xml', 'r') as file:
    applocker.load(file)

The function applocker.loads, loads an AppLocker Policy XML string.

applocker.loads('<AppLockerPolicy Version="1" />')

In addition to loading an existing AppLocker Policy, policies created using the relevant Conditions, Rules and Rule Collections can be dumped to an XML file using the applocker.dump function.

with open('example.xml', 'w') as file:
    applocker.dump(policy, file)

Or, an XML string using the applocker.dumps function.

applocker.dumps(policy)

FilePublisherRule

To create a file publisher AppLocker rule to allow or deny digitally signed files, a applocker.conditions.FilePublisherCondition must be created optionally specifying a applocker.conditions.BinaryVersionRange.

This condition can then be used to create a applocker.rules.FilePublisherRule.

from applocker.conditions import BinaryVersionRange, FilePublisherCondition
from applocker.rules import FilePublisherRule

binary_version_range = BinaryVersionRange(low_section='10.0.19041.1', high_section='10.0.19041.1')

condition = FilePublisherCondition(
    publisher_name='O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US',
    product_name='MICROSOFT® WINDOWS® OPERATING SYSTEM',
    binary_name='CMD.EXE',
    binary_version_range=binary_version_range
)

rule = FilePublisherRule(
    id='00000000-0000-0000-0000-000000000000',
    name='Deny everyone execution of cmd.exe',
    description='',
    user_or_group_sid='S-1-1-0',
    action='Deny',
    conditions=[
        condition
    ]
)

FilePathRule

To create a file path AppLocker rule to allow or deny files based upon their path, a applocker.conditions.FilePathCondition condition must be created.

This condition can then be used to create a applocker.rules.FilePathRule.

from applocker.conditions import FilePathCondition
from applocker.rules import FilePathRule

condition = FilePathCondition(path='C:\Windows\System32\cmd.exe')

rule = FilePathRule(
    id='00000000-0000-0000-0000-000000000000',
    name='Deny everyone execution of cmd.exe',
    description='',
    user_or_group_sid='S-1-1-0',
    action='Deny',
    conditions=[
        condition
    ]
)

FileHashRule

To create a file hash AppLocker rule to allow or deny files based upon their hash, one or more applocker.conditions.FileHash objects and a applocker.conditions.FileHashCondition condition must be created.

This condition can then be used to create a applocker.rules.FileHashRule.

from applocker.conditions import FileHash, FileHashCondition
from applocker.rules import FileHashRule

hash = FileHash(
    type='SHA256',
    data='0x9BB897814C6E1A2A2701D2ADB59AAC2BCACB9CF265DDF3F61B9056EA6FFE04C7',
    source_file_name='cmd.exe',
    source_file_length='289792'
)

condition = FileHashCondition(file_hashes=[hash])

rule = FileHashRule(
    id='00000000-0000-0000-0000-000000000000',
    name='Deny everyone execution of cmd.exe',
    description='',
    user_or_group_sid='S-1-1-0',
    action='Deny',
    conditions=[
        condition
    ]
)

RuleCollection

To create a rule collection one or more rules must be created as described above.

These rules can then be used to create a applocker.rules.RuleCollection.

from applocker.rules import RuleCollection

rule_collection = RuleCollection(
    type='Exe',
    enforcement_mode='Enforcing',
    rules=[
        rule
    ]
)

AppLockerPolicy

To create an AppLocker Policy one or more rule collections must be created as described above.

These rule collections can then be used to create an applocker.policy.AppLockerPolicy.

from applocker.policy import AppLockerPolicy

policy = AppLockerPolicy(
    version='1',
    rule_collections=[
        rule_collection
    ]
)