AppLocker FileHash

Question

Hi All,

I have an issue which I can't find a proper solution for. I'm using AppLocker in an environment which also contains a SIEM solution. What I want to forward to the SIEM solution is 'blocked applications by AppLocker'. The issue is that I don't have enough information from the standard events. There's a filename, location etc. but what I really would like is a hash of the file which is blocked. So if mimikatz is renamed to client.exe and run in C:\Temp I can use the hash to see if it's malicious.

There's an "audit-mode" option in AppLocker which logs the fileHash, but then it doesn't block the application since it's auditing only. I can't create two GPO's which one GPO is set to enforced and the other to audit, because enforced takes precedence over the audit and no audit gets logged.

How do I get the hash of the file and AppLocker to work at the same time?

I know the "fileHash" property in AppLocker is an Authenticode Hash of the file and I can't get my head around why Microsoft doesn't log a SHA hash for every blocked application.

With kind regards,

AvanadeR

Answer 1

Thank you for the reply...

What I want is the hash in the eventviewer of the client. I know you can block files based on a hash, but I want the hash to be logged when an application is being blocked in the eventviewer. All it know contains is the filename and path which is helpful, but if it says "client.exe" started in "C:\Temp", there's no way to check what the file actually is without checking the source. If there's a hash (SHA or MD5) in the eventviewer, I can take a look online what file it is without checking the source.

Answer 2

Hi,

Please check the following links

Understanding the file hash rule condition in AppLocker

https://docs.microsoft.com/en-us/windows/securi...

AppLocker processes and interactions

https://docs.microsoft.com/en-us/windows/securi...

Use AppLocker and Software Restriction Policies in the same domain

https://docs.microsoft.com/en-us/windows/securi...

Let me know if that helps.

Kind Regards,

Engr. Jamshed Muhammad