├── AppLocker Event Forwarding
    ├── AppLocker Event Forwarding Subscription Query Filter.xml
    ├── AppLocker Events grouped by File.ps1
    └── AppLocker Events to CSV.ps1
├── AppLocker Starter Policy
    ├── Windows10_AppLocker Starter Policy.xml
    └── Windows11_AppLocker Starter Policy.xml
├── Create AppLocker Meta Events
    ├── AppLocker Event Forwarding Subscription Meta Event Query Filter xml
    ├── AppLocker Meta Events Custom View.xml
    ├── AppLocker Meta Events grouped by File.ps1
    ├── AppLocker Meta Events to CSV.ps1
    ├── Create AppLocker Meta Event Task.bat
    ├── Create AppLocker Meta Event Task.xml
    └── Create AppLocker Meta Event.ps1
├── Create AppLocker Popup Task
    ├── AppLocker Popup Alert Task.xml
    └── Create AppLocker Popup Task.bat
├── DISCLAIMER.md
├── Event Viewer AppLocker Custom View
    └── AppLocker Event Viewer Custom View.xml
├── LICENSE.md
└── README.md


/AppLocker Event Forwarding/AppLocker Event Forwarding Subscription Query Filter.xml:
--------------------------------------------------------------------------------
 1 | When setting up an event forwarding subscription, it is necessary to tell the subscription 
 2 | which events are desired for forwarding.  The following event query can be used within an 
 3 | event subscription to select only the AppLocker warning and error events for forwarding:
 4 | 
 5 | <QueryList>
 6 |   <Query Id="0" Path="Microsoft-Windows-AppLocker/EXE and DLL">
 7 |     <Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*[System[Provider[@Name='Microsoft-Windows-AppLocker'] and (Level=1  or Level=2 or Level=3)]]</Select>
 8 |     <Select Path="Microsoft-Windows-AppLocker/MSI and Script">*[System[Provider[@Name='Microsoft-Windows-AppLocker'] and (Level=1  or Level=2 or Level=3)]]</Select>
 9 |   </Query>
10 | </QueryList>


--------------------------------------------------------------------------------
/AppLocker Event Forwarding/AppLocker Events grouped by File.ps1:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/AppLocker Event Forwarding/AppLocker Events grouped by File.ps1


--------------------------------------------------------------------------------
/AppLocker Event Forwarding/AppLocker Events to CSV.ps1:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/AppLocker Event Forwarding/AppLocker Events to CSV.ps1


--------------------------------------------------------------------------------
/AppLocker Starter Policy/Windows10_AppLocker Starter Policy.xml:
--------------------------------------------------------------------------------
   1 | <!--
   2 | This file is an AppLocker Policy xml file that can be imported using the Group Policy Management Editor 
   3 | to automatically configure a starting location-based application allowlisting policy for initial auditing.
   4 | Once applied, the events will need to be reviewed to tailor the policy to the network.
   5 | -->
   6 | <AppLockerPolicy Version="1">
   7 |   <RuleCollection Type="Dll" EnforcementMode="AuditOnly">
   8 |     <FilePathRule Id="1d04fdc7-5e29-45b1-a0d7-f7e9293774f8" Name="Allows administrators to execute all DLLs" Description="Allows members of the local Administrators group to load all DLLs." UserOrGroupSid="S-1-5-32-544" Action="Allow">
   9 |       <Conditions>
  10 |         <FilePathCondition Path="*" />
  11 |       </Conditions>
  12 |     </FilePathRule>
  13 |     <FilePathRule Id="7ca2deae-991c-4e26-b688-98137f9cc777" Name="Allow everyone to execute all DLLs located in the Windows folder" Description="Allows members of the Everyone group to load DLLs located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow">
  14 |       <Conditions>
  15 |         <FilePathCondition Path="%WINDIR%\*" />
  16 |       </Conditions>
  17 |       <Exceptions>
  18 |         <FilePathCondition Path="%SYSTEM32%\catroot2\*" />
  19 |         <FilePathCondition Path="%SYSTEM32%\com\dmp\*" />
  20 |         <FilePathCondition Path="%SYSTEM32%\FxsTmp\*" />
  21 |         <FilePathCondition Path="%SYSTEM32%\spool\drivers\color\*" />
  22 |         <FilePathCondition Path="%SYSTEM32%\spool\PRINTERS\*" />
  23 |         <FilePathCondition Path="%SYSTEM32%\spool\SERVERS\*" />
  24 |         <FilePathCondition Path="%SYSTEM32%\Tasks\*" />
  25 |         <FilePathCondition Path="%WINDIR%\Debug\*" />
  26 |         <FilePathCondition Path="%WINDIR%\PCHEALTH\ERRORREP\*" />
  27 |         <FilePathCondition Path="%WINDIR%\Registration\*" />
  28 |         <FilePathCondition Path="%WINDIR%\SysWOW64\com\dmp\*" />
  29 |         <FilePathCondition Path="%WINDIR%\SysWOW64\FxsTmp\*" />
  30 |         <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\*" />
  31 |         <FilePathCondition Path="%WINDIR%\Tasks\*" />
  32 |         <FilePathCondition Path="%WINDIR%\Temp\*" />
  33 |         <FilePathCondition Path="%WINDIR%\tracing\*" />
  34 |       </Exceptions>
  35 |     </FilePathRule>
  36 |     <FilePathRule Id="f36fbeba-ab50-48c0-9361-41af365d82ce" Name="Allow everyone to execute all DLLs located in the Program Files folder" Description="Allows members of the Everyone group to load DLLs that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow">
  37 |       <Conditions>
  38 |         <FilePathCondition Path="%PROGRAMFILES%\*" />
  39 |       </Conditions>
  40 |     </FilePathRule>
  41 | 	 <!--MS recommended block rules added below V-->
  42 | 	<FilePublisherRule Id="378add63-6447-47ee-8d90-0be4acc36124" Name="DAVSVC.DLL version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  43 |       <Conditions>
  44 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="DAVSVC.DLL">
  45 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  46 |         </FilePublisherCondition>
  47 |       </Conditions>
  48 |     </FilePublisherRule>
  49 |     <FileHashRule Id="c9880870-3972-4f3e-85cb-8b005a63bb5d" Name="LxssManager.dll" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  50 |       <Conditions>
  51 |         <FileHashCondition>
  52 |           <FileHash Type="SHA256" Data="0x54C94BF6CD397A0B3F2B2215A52AE1AA479FD9FA1E148F3617865A073723375C" SourceFileName="LxssManager.dll" SourceFileLength="30367" />
  53 |         </FileHashCondition>
  54 |       </Conditions>
  55 |     </FileHashRule>
  56 |     <FilePublisherRule Id="6b7bd524-6d26-4ee1-987c-2d46029b028c" Name="MICROSOFT.BUILD.DLL version 4.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  57 |       <Conditions>
  58 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="MICROSOFT.BUILD.DLL">
  59 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  60 |         </FilePublisherCondition>
  61 |       </Conditions>
  62 |     </FilePublisherRule>
  63 |     <FilePublisherRule Id="0f8ea8c2-069f-44df-b8c6-4d6efc31090c" Name="MICROSOFT.BUILD.FRAMEWORK.DLL version 3.5.30729.9151 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  64 |       <Conditions>
  65 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="MICROSOFT.BUILD.FRAMEWORK.DLL">
  66 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  67 |         </FilePublisherCondition>
  68 |       </Conditions>
  69 |     </FilePublisherRule>
  70 |     <FilePublisherRule Id="b6cb2308-a3e1-4dd2-a46b-54e21e4537a1" Name="SYSTEM.MANAGEMENT.AUTOMATION.DLL version 10.0.22000.65 exactly in MICROSOFT (R) WINDOWS (R) OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  71 |       <Conditions>
  72 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT (R) WINDOWS (R) OPERATING SYSTEM" BinaryName="SYSTEM.MANAGEMENT.AUTOMATION.DLL">
  73 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  74 |         </FilePublisherCondition>
  75 |       </Conditions>
  76 |     </FilePublisherRule>
  77 |     <!--MS recommended block rules added above ^-->
  78 |     <!--LOLBAS block rules added below V-->
  79 |     <FilePublisherRule Id="fe5c6b39-64ef-4a4f-84a0-47bfe6ac16ca" Name="ADVPACK.DLL version 11.0.22000.1 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  80 |       <Conditions>
  81 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="ADVPACK.DLL">
  82 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  83 |         </FilePublisherCondition>
  84 |       </Conditions>
  85 |     </FilePublisherRule>
  86 |     <FilePublisherRule Id="8e8cd94f-d6b0-40c8-964d-9de02e712d7a" Name="COMSVCS.DLL version 2001.12.10941.16384 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  87 |       <Conditions>
  88 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="COMSVCS.DLL">
  89 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  90 |         </FilePublisherCondition>
  91 |       </Conditions>
  92 |     </FilePublisherRule>
  93 |     <FilePublisherRule Id="6248280d-b08a-4e0b-9afe-85057423a93f" Name="ADVPACK.DLL version 11.0.22000.1 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
  94 |       <Conditions>
  95 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="ADVPACK.DLL">
  96 |           <BinaryVersionRange LowSection="*" HighSection="*" />
  97 |         </FilePublisherCondition>
  98 |       </Conditions>
  99 |     </FilePublisherRule>
 100 |     <FilePublisherRule Id="8a34541f-04a7-4512-901d-a216e4cfe3bd" Name="IEFRAME.DLL version 11.0.22000.194 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 101 |       <Conditions>
 102 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="IEFRAME.DLL">
 103 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 104 |         </FilePublisherCondition>
 105 |       </Conditions>
 106 |     </FilePublisherRule>
 107 |     <!-- Rule affects usage of Event Viewer -->
 108 |     <!-- <FilePublisherRule Id="283fe2be-3e7c-4cae-8bc3-20c25b151759" Name="MSHTML.DLL version 11.0.22000.556 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 109 | 		<Conditions>
 110 | 			<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="MSHTML.DLL">
 111 | 				<BinaryVersionRange LowSection="*" HighSection="*" />
 112 | 			</FilePublisherCondition>
 113 | 		</Conditions>
 114 | 	</FilePublisherRule> -->
 115 |     <FilePublisherRule Id="be306129-9645-4d5d-beb4-34c86c23f06b" Name="PCWUTL.DLL version 10.0.22000.120 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 116 |       <Conditions>
 117 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PCWUTL.DLL">
 118 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 119 |         </FilePublisherCondition>
 120 |       </Conditions>
 121 |     </FilePublisherRule>
 122 |     <FilePublisherRule Id="47a1573a-bd70-4c5e-a040-78e4f10201ac" Name="SETUPAPI.DLL version 10.0.22000.194 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 123 |       <Conditions>
 124 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="SETUPAPI.DLL">
 125 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 126 |         </FilePublisherCondition>
 127 |       </Conditions>
 128 |     </FilePublisherRule>
 129 |     <FilePublisherRule Id="a7f350b9-9450-4920-9989-fb5b01bca666" Name="SHDOCVW.DLL version 10.0.22000.65 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 130 |       <Conditions>
 131 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="SHDOCVW.DLL">
 132 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 133 |         </FilePublisherCondition>
 134 |       </Conditions>
 135 |     </FilePublisherRule>
 136 |     <FilePublisherRule Id="d404c0af-42ec-4b03-a596-ff57937e9ed8" Name="SHELL32.DLL version 10.0.22000.120 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 137 |       <Conditions>
 138 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="SHELL32.DLL">
 139 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 140 |         </FilePublisherCondition>
 141 |       </Conditions>
 142 |     </FilePublisherRule>
 143 |     <FilePublisherRule Id="90889ce0-5800-48f6-ab18-c794c4ccded1" Name="SYSSETUP.DLL version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 144 |       <Conditions>
 145 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="SYSSETUP.DLL">
 146 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 147 |         </FilePublisherCondition>
 148 |       </Conditions>
 149 |     </FilePublisherRule>
 150 |     <FilePublisherRule Id="b78eddc5-3c5f-457f-85cf-b1e3191d8efe" Name="URL.DLL version 11.0.22000.1 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 151 |       <Conditions>
 152 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="URL.DLL">
 153 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 154 |         </FilePublisherCondition>
 155 |       </Conditions>
 156 |     </FilePublisherRule>
 157 |     <FilePublisherRule Id="3b93b3cb-2707-4437-a8bb-235fbbf7196f" Name="ZIPFLDR.DLL version 10.0.22000.71 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 158 |       <Conditions>
 159 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="ZIPFLDR.DLL">
 160 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 161 |         </FilePublisherCondition>
 162 |       </Conditions>
 163 |     </FilePublisherRule>
 164 |     <!--LOLBAS block rules added above ^-->   
 165 |   </RuleCollection>
 166 |   <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
 167 |     <FilePublisherRule Id="187ae870-255e-42d7-8ef9-9a8434a70716" Name="Prevent administrators from easily running the Internet Explorer web browser" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 168 |       <Conditions>
 169 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="WINDOWS® INTERNET EXPLORER" BinaryName="IEXPLORE.EXE">
 170 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 171 |         </FilePublisherCondition>
 172 |       </Conditions>
 173 |     </FilePublisherRule>
 174 |     <FilePublisherRule Id="230ebde7-123f-4f56-9caf-a412e5265300" Name="Prevent administrators from easily running the Outlook email client" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 175 |       <Conditions>
 176 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT OFFICE OUTLOOK" BinaryName="OUTLOOK.EXE">
 177 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 178 |         </FilePublisherCondition>
 179 |       </Conditions>
 180 |     </FilePublisherRule>
 181 |     <FilePublisherRule Id="54d44e7f-44b7-4d8d-961e-6d9c47e03196" Name="Prevent administrators from easily running the Thunderbird email client" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 182 |       <Conditions>
 183 |         <FilePublisherCondition PublisherName="O=MOZILLA MESSAGING INC., L=MOUNTAIN VIEW, S=CALIFORNIA, C=US" ProductName="THUNDERBIRD" BinaryName="thunderbird.exe">
 184 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 185 |         </FilePublisherCondition>
 186 |       </Conditions>
 187 |     </FilePublisherRule>
 188 |     <FilePublisherRule Id="97bca7b1-6ff4-40a5-a1fe-e8e8535f6e1e" Name="Prevent administrators from easily running the Chrome web browser" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 189 |       <Conditions>
 190 |         <FilePublisherCondition PublisherName="O=GOOGLE INC, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US" ProductName="GOOGLE CHROME" BinaryName="chrome.exe">
 191 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 192 |         </FilePublisherCondition>
 193 |       </Conditions>
 194 |     </FilePublisherRule>
 195 |     <FilePublisherRule Id="980f805b-bc66-43c7-95c4-90ef50fe5b04" Name="Prevent administrators from easily running the Firefox web browser" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 196 |       <Conditions>
 197 |         <FilePublisherCondition PublisherName="O=MOZILLA CORPORATION, L=MOUNTAIN VIEW, S=CALIFORNIA, C=US" ProductName="FIREFOX" BinaryName="firefox.exe">
 198 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 199 |         </FilePublisherCondition>
 200 |       </Conditions>
 201 |     </FilePublisherRule>
 202 |     <FilePublisherRule Id="a88c9192-bbed-4dfe-b435-d0ca25f6576e" Name="Prevent administrators from easily running the Opera web browser" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 203 |       <Conditions>
 204 |         <FilePublisherCondition PublisherName="O=OPERA SOFTWARE ASA, S=OSLO, C=NO" ProductName="OPERA" BinaryName="opera.exe">
 205 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 206 |         </FilePublisherCondition>
 207 |       </Conditions>
 208 |     </FilePublisherRule>
 209 |     <FilePublisherRule Id="f53c8fc8-d0dd-43c4-b874-57f31ba6f4aa" Name="Prevent administrators from easily running the Safari web browser" Description="" UserOrGroupSid="S-1-5-32-544" Action="Deny">
 210 |       <Conditions>
 211 |         <FilePublisherCondition PublisherName="O=APPLE INC., L=CUPERTINO, S=CALIFORNIA, C=US" ProductName="SAFARI" BinaryName="Safari.exe">
 212 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 213 |         </FilePublisherCondition>
 214 |       </Conditions>
 215 |     </FilePublisherRule>
 216 |     <FilePathRule Id="1712f2de-e1b6-4d3d-85a9-a7da49b796c1" Name="Allow everyone to execute all files located in the Program Files folder" Description="Allows members of the Everyone group to run applications that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow">
 217 |       <Conditions>
 218 |         <FilePathCondition Path="%PROGRAMFILES%\*" />
 219 |       </Conditions>
 220 |     </FilePathRule>
 221 |     <FilePathRule Id="afd4074c-4b47-4b55-bb6d-f35ea215408b" Name="Allow everyone to execute all files located in the Windows folder" Description="Allows members of the Everyone group to run applications that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow">
 222 |       <Conditions>
 223 |         <FilePathCondition Path="%WINDIR%\*" />
 224 |       </Conditions>
 225 |       <Exceptions>
 226 |         <FilePathCondition Path="%SYSTEM32%\catroot2\*" />
 227 |         <FilePathCondition Path="%SYSTEM32%\com\dmp\*" />
 228 |         <FilePathCondition Path="%SYSTEM32%\FxsTmp\*" />
 229 |         <FilePathCondition Path="%SYSTEM32%\spool\drivers\color\*" />
 230 |         <FilePathCondition Path="%SYSTEM32%\spool\PRINTERS\*" />
 231 |         <FilePathCondition Path="%SYSTEM32%\spool\SERVERS\*" />
 232 |         <FilePathCondition Path="%SYSTEM32%\Tasks\*" />
 233 |         <FilePathCondition Path="%WINDIR%\Debug\*" />
 234 |         <FilePathCondition Path="%WINDIR%\PCHEALTH\ERRORREP\*" />
 235 |         <FilePathCondition Path="%WINDIR%\Registration\*" />
 236 |         <FilePathCondition Path="%WINDIR%\SysWOW64\com\dmp\*" />
 237 |         <FilePathCondition Path="%WINDIR%\SysWOW64\FxsTmp\*" />
 238 |         <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\*" />
 239 |         <FilePathCondition Path="%WINDIR%\Tasks\*" />
 240 |         <FilePathCondition Path="%WINDIR%\Temp\*" />
 241 |         <FilePathCondition Path="%WINDIR%\tracing\*" />
 242 |       </Exceptions>
 243 |     </FilePathRule>
 244 |     <FilePathRule Id="f301f291-10d9-4423-8f9c-a78afe9d4ea5" Name="Allow administrators to execute all files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow">
 245 |       <Conditions>
 246 |         <FilePathCondition Path="*" />
 247 |       </Conditions>
 248 |     </FilePathRule>
 249 |     <!--LOLBAS rules added below V-->
 250 |     <FilePublisherRule Id="6e079dcf-507a-4e8e-9021-64397b4c90fe" Name="AT.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 251 |       <Conditions>
 252 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="AT.EXE">
 253 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 254 |         </FilePublisherCondition>
 255 |       </Conditions>
 256 |     </FilePublisherRule>
 257 |     <FilePublisherRule Id="8f71d0ed-4eaa-4078-9a9a-eb6d4a91f114" Name="ATBROKER.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 258 |       <Conditions>
 259 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="ATBROKER.EXE">
 260 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 261 |         </FilePublisherCondition>
 262 |       </Conditions>
 263 |     </FilePublisherRule>
 264 |     <FilePublisherRule Id="a4bb32af-676f-4934-8448-72467819dc21" Name="BITSADMIN.EXE version 7.8.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 265 |       <Conditions>
 266 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="BITSADMIN.EXE">
 267 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 268 |         </FilePublisherCondition>
 269 |       </Conditions>
 270 |     </FilePublisherRule>
 271 |     <FilePublisherRule Id="8f27de7c-c631-449b-977a-5f96f898496c" Name="CERTREQ.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 272 |       <Conditions>
 273 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CERTREQ.EXE">
 274 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 275 |         </FilePublisherCondition>
 276 |       </Conditions>
 277 |     </FilePublisherRule>
 278 |     <FilePublisherRule Id="1e911c93-7c4c-4f8f-8b3d-86026fc711f6" Name="CERTUTIL.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 279 |       <Conditions>
 280 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CERTUTIL.EXE">
 281 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 282 |         </FilePublisherCondition>
 283 |       </Conditions>
 284 |     </FilePublisherRule>
 285 |     <FilePublisherRule Id="f9ae3b54-6731-426f-8050-159c397c5159" Name="CMDKEY.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 286 |       <Conditions>
 287 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CMDKEY.EXE">
 288 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 289 |         </FilePublisherCondition>
 290 |       </Conditions>
 291 |     </FilePublisherRule>
 292 |     <FilePublisherRule Id="7dd0d8d4-edcd-497d-80c5-65d5413639f4" Name="CMDL32.EXE version 7.2.22000.1 exactly in MICROSOFT(R) CONNECTION MANAGER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 293 |       <Conditions>
 294 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT(R) CONNECTION MANAGER" BinaryName="CMDL32.EXE">
 295 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 296 |         </FilePublisherCondition>
 297 |       </Conditions>
 298 |     </FilePublisherRule>
 299 |     <FilePublisherRule Id="4ac05c1c-e527-4b99-b46c-2d2282f0ca74" Name="CMSTP.EXE version 7.2.22000.1 exactly in MICROSOFT(R) CONNECTION MANAGER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 300 |       <Conditions>
 301 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT(R) CONNECTION MANAGER" BinaryName="CMSTP.EXE">
 302 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 303 |         </FilePublisherCondition>
 304 |       </Conditions>
 305 |     </FilePublisherRule>
 306 |     <FilePublisherRule Id="c607db17-7c13-44fc-81ed-2f5cdbc01088" Name="CONFIGSECURITYPOLICY.EXE version 4.18.1907.16384 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 307 |       <Conditions>
 308 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CONFIGSECURITYPOLICY.EXE">
 309 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 310 |         </FilePublisherCondition>
 311 |       </Conditions>
 312 |     </FilePublisherRule>
 313 |     <FilePublisherRule Id="27fd45f5-b876-4e01-b5a4-196e7859b59b" Name="CONHOST.EXE version 10.0.22000.120 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 314 |       <Conditions>
 315 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CONHOST.EXE">
 316 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 317 |         </FilePublisherCondition>
 318 |       </Conditions>
 319 |     </FilePublisherRule>
 320 |     <FilePublisherRule Id="c8d18d29-307b-4a9c-94ff-bef3f33733f1" Name="CONTROL.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 321 |       <Conditions>
 322 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CONTROL.EXE">
 323 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 324 |         </FilePublisherCondition>
 325 |       </Conditions>
 326 |     </FilePublisherRule>
 327 |     <FilePublisherRule Id="6cd7fd0f-d757-414a-a6c7-8c7822fe0107" Name="CSC.EXE version 4.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 328 |       <Conditions>
 329 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="CSC.EXE">
 330 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 331 |         </FilePublisherCondition>
 332 |       </Conditions>
 333 |     </FilePublisherRule>
 334 |     <FilePublisherRule Id="55a5e935-514f-4dcb-9bf7-5b59a6e909b7" Name="CUSTOMSHELLHOST.EXE version 10.0.22000.120 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 335 |       <Conditions>
 336 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CUSTOMSHELLHOST.EXE">
 337 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 338 |         </FilePublisherCondition>
 339 |       </Conditions>
 340 |     </FilePublisherRule>
 341 |     <FilePublisherRule Id="332f4754-6cc7-4210-9256-3ea088e0b5f2" Name="DATASVCUTIL.EXE version 3.5.30729.9151 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 342 |       <Conditions>
 343 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="DATASVCUTIL.EXE">
 344 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 345 |         </FilePublisherCondition>
 346 |       </Conditions>
 347 |     </FilePublisherRule>
 348 |     <FilePublisherRule Id="5423e300-ae6c-4a32-bff0-aa53be4b28e0" Name="DESKTOPIMGDOWNLDR.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 349 |       <Conditions>
 350 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="DESKTOPIMGDOWNLDR.EXE">
 351 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 352 |         </FilePublisherCondition>
 353 |       </Conditions>
 354 |     </FilePublisherRule>
 355 |     <FilePublisherRule Id="0f47bfda-9e4f-45e2-9eaa-b0676495fdae" Name="&quot;DEVICECREDENTIALDEPLOYMENT.EXE&quot; version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 356 |       <Conditions>
 357 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="&quot;DEVICECREDENTIALDEPLOYMENT.EXE&quot;">
 358 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 359 |         </FilePublisherCondition>
 360 |       </Conditions>
 361 |     </FilePublisherRule>
 362 |     <FilePublisherRule Id="3fb45c08-04e5-4890-bde3-fae15aa2a4f6" Name="DFSVC.EXE version 2.0.50727.9157 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 363 |       <Conditions>
 364 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="DFSVC.EXE">
 365 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 366 |         </FilePublisherCondition>
 367 |       </Conditions>
 368 |     </FilePublisherRule>
 369 |     <FilePublisherRule Id="63607dea-856f-46f5-a62c-7242dcc530fd" Name="ESENTUTL.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 370 |       <Conditions>
 371 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="ESENTUTL.EXE">
 372 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 373 |         </FilePublisherCondition>
 374 |       </Conditions>
 375 |     </FilePublisherRule>
 376 |     <FilePublisherRule Id="8e5bba0b-8df9-4449-a1fa-6a56b07a2658" Name="EVENTVWR.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 377 |       <Conditions>
 378 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="EVENTVWR.EXE">
 379 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 380 |         </FilePublisherCondition>
 381 |       </Conditions>
 382 |     </FilePublisherRule>
 383 |     <FilePublisherRule Id="255df978-9134-4f19-bd29-bb7ee6183456" Name="EXPAND version 5.0.1.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 384 |       <Conditions>
 385 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="EXPAND">
 386 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 387 |         </FilePublisherCondition>
 388 |       </Conditions>
 389 |     </FilePublisherRule>
 390 |     <FilePublisherRule Id="ac3c9d26-8667-430b-9dbe-b88ea206fbde" Name="EXPLORER.EXE version 10.0.22000.120 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 391 |       <Conditions>
 392 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="EXPLORER.EXE">
 393 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 394 |         </FilePublisherCondition>
 395 |       </Conditions>
 396 |     </FilePublisherRule>
 397 |     <FilePublisherRule Id="2c2c8385-4788-4e2a-89f5-1355723b7089" Name="EXTEXPORT.EXE version 11.0.22000.1 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 398 |       <Conditions>
 399 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="EXTEXPORT.EXE">
 400 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 401 |         </FilePublisherCondition>
 402 |       </Conditions>
 403 |     </FilePublisherRule>
 404 |     <FilePublisherRule Id="6731f23a-6b63-4429-9f57-353220964200" Name="EXTRAC32.EXE version 5.0.1.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 405 |       <Conditions>
 406 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="EXTRAC32.EXE">
 407 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 408 |         </FilePublisherCondition>
 409 |       </Conditions>
 410 |     </FilePublisherRule>
 411 |     <FilePublisherRule Id="968480ad-f53e-408d-aff4-a4c89d86e399" Name="FINDSTR.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 412 |       <Conditions>
 413 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="FINDSTR.EXE">
 414 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 415 |         </FilePublisherCondition>
 416 |       </Conditions>
 417 |     </FilePublisherRule>
 418 |     <FilePublisherRule Id="4d24394b-2d58-415c-830f-7fb05e826a78" Name="FINGER.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 419 |       <Conditions>
 420 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="FINGER.EXE">
 421 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 422 |         </FilePublisherCondition>
 423 |       </Conditions>
 424 |     </FilePublisherRule>
 425 |     <FilePublisherRule Id="69b6ec32-8f59-4866-8fed-43bc24da0710" Name="FLTMC.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 426 |       <Conditions>
 427 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="FLTMC.EXE">
 428 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 429 |         </FilePublisherCondition>
 430 |       </Conditions>
 431 |     </FilePublisherRule>
 432 |     <FilePublisherRule Id="e8eaf929-8095-49e8-b3b2-ba5b6a6c72a2" Name="FORFILES.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 433 |       <Conditions>
 434 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="FORFILES.EXE">
 435 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 436 |         </FilePublisherCondition>
 437 |       </Conditions>
 438 |     </FilePublisherRule>
 439 |     <FilePublisherRule Id="91c3b02c-cf98-4c0d-8528-d2c160f8cb9b" Name="FSUTIL.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 440 |       <Conditions>
 441 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="FSUTIL.EXE">
 442 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 443 |         </FilePublisherCondition>
 444 |       </Conditions>
 445 |     </FilePublisherRule>
 446 |     <FilePublisherRule Id="a578c78a-6eed-4d60-856b-a0fb70358bfe" Name="FTP.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 447 |       <Conditions>
 448 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="FTP.EXE">
 449 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 450 |         </FilePublisherCondition>
 451 |       </Conditions>
 452 |     </FilePublisherRule>
 453 |     <FilePublisherRule Id="889a2ec5-1624-4d4a-963e-d5b523307565" Name="GPSCRIPT.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 454 |       <Conditions>
 455 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="GPSCRIPT.EXE">
 456 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 457 |         </FilePublisherCondition>
 458 |       </Conditions>
 459 |     </FilePublisherRule>
 460 |     <FilePublisherRule Id="81f303ae-d91f-4a80-bf0a-1e018777446c" Name="HH.EXE version 10.0.22000.1 exactly in HTML HELP from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 461 |       <Conditions>
 462 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="HTML HELP" BinaryName="HH.EXE">
 463 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 464 |         </FilePublisherCondition>
 465 |       </Conditions>
 466 |     </FilePublisherRule>
 467 |     <FilePublisherRule Id="a6d73fd9-7543-47d5-834f-86a23034dfd0" Name="IE4UINIT.EXE version 11.0.22000.65 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 468 |       <Conditions>
 469 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="IE4UINIT.EXE">
 470 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 471 |         </FilePublisherCondition>
 472 |       </Conditions>
 473 |     </FilePublisherRule>
 474 |     <FilePublisherRule Id="eeb18663-049b-46e7-82af-e817899d1469" Name="IEEXEC.EXE version 2.0.50727.9157 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 475 |       <Conditions>
 476 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="IEEXEC.EXE">
 477 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 478 |         </FilePublisherCondition>
 479 |       </Conditions>
 480 |     </FilePublisherRule>
 481 |     <FilePublisherRule Id="fbc1eb55-ed83-4a07-b9a4-8d97e5558e99" Name="ILASM.EXE version 4.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 482 |       <Conditions>
 483 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="ILASM.EXE">
 484 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 485 |         </FilePublisherCondition>
 486 |       </Conditions>
 487 |     </FilePublisherRule>
 488 |     <FilePublisherRule Id="e437382d-18fb-4ebc-92bf-72948fbc4eff" Name="IMEWDBLD.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 489 |       <Conditions>
 490 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="IMEWDBLD.EXE">
 491 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 492 |         </FilePublisherCondition>
 493 |       </Conditions>
 494 |     </FilePublisherRule>
 495 |     <FilePublisherRule Id="45c9b469-549e-4d70-8450-8008faeddbad" Name="INSTALLUTIL.EXE version 2.0.50727.9157 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 496 |       <Conditions>
 497 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="INSTALLUTIL.EXE">
 498 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 499 |         </FilePublisherCondition>
 500 |       </Conditions>
 501 |     </FilePublisherRule>
 502 |     <FilePublisherRule Id="7fd57194-b2f4-4ec1-8e1f-95813ad2b075" Name="JSC.EXE version 14.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 503 |       <Conditions>
 504 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="JSC.EXE">
 505 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 506 |         </FilePublisherCondition>
 507 |       </Conditions>
 508 |     </FilePublisherRule>
 509 |     <FilePublisherRule Id="e04883f7-6565-4d2d-bc70-91038a088f65" Name="MAKECAB.EXE version 5.0.1.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 510 |       <Conditions>
 511 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="MAKECAB.EXE">
 512 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 513 |         </FilePublisherCondition>
 514 |       </Conditions>
 515 |     </FilePublisherRule>
 516 |     <FilePublisherRule Id="493d9c34-e92d-44bc-a6cf-193aac45b091" Name="MAVINJECT64.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 517 |       <Conditions>
 518 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="MAVINJECT64.EXE">
 519 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 520 |         </FilePublisherCondition>
 521 |       </Conditions>
 522 |     </FilePublisherRule>
 523 |     <FilePublisherRule Id="18cc01ab-8c34-4e4e-bea9-82df59d6c517" Name="MMC.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 524 |       <Conditions>
 525 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="MMC.EXE">
 526 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 527 |         </FilePublisherCondition>
 528 |       </Conditions>
 529 |     </FilePublisherRule>
 530 |     <FilePublisherRule Id="0d2fc6e7-e475-4546-ac9e-758b0ad31835" Name="MSCONFIG.EXE version 10.0.22000.71 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 531 |       <Conditions>
 532 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="MSCONFIG.EXE">
 533 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 534 |         </FilePublisherCondition>
 535 |       </Conditions>
 536 |     </FilePublisherRule>
 537 |     <FilePublisherRule Id="b2378874-ccd4-4d73-9e7a-f455160d8a44" Name="MSDT.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 538 |       <Conditions>
 539 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="MSDT.EXE">
 540 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 541 |         </FilePublisherCondition>
 542 |       </Conditions>
 543 |     </FilePublisherRule>
 544 |     <FilePublisherRule Id="6250d7c2-95ce-465b-877b-d46228f4a693" Name="MSIEXEC.EXE version 5.0.22000.1 exactly in WINDOWS INSTALLER - UNICODE from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 545 |       <Conditions>
 546 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="WINDOWS INSTALLER - UNICODE" BinaryName="MSIEXEC.EXE">
 547 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 548 |         </FilePublisherCondition>
 549 |       </Conditions>
 550 |     </FilePublisherRule>
 551 |     <FilePublisherRule Id="25b83c2d-1d51-482a-8aec-8007a9b4bc58" Name="NETSH.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 552 |       <Conditions>
 553 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="NETSH.EXE">
 554 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 555 |         </FilePublisherCondition>
 556 |       </Conditions>
 557 |     </FilePublisherRule>
 558 |     <FilePublisherRule Id="86b059ab-9006-4dc2-8f23-4b6c8df78327" Name="ODBCCONF.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 559 |       <Conditions>
 560 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="ODBCCONF.EXE">
 561 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 562 |         </FilePublisherCondition>
 563 |       </Conditions>
 564 |     </FilePublisherRule>
 565 |     <FilePublisherRule Id="e9b6e4ca-b4d6-49ad-a2fa-00429e80b4c6" Name="OFFLINESCANNERSHELL.EXE version 4.18.1907.16384 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 566 |       <Conditions>
 567 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="OFFLINESCANNERSHELL.EXE">
 568 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 569 |         </FilePublisherCondition>
 570 |       </Conditions>
 571 |     </FilePublisherRule>
 572 |     <FileHashRule Id="98a4c24b-2028-42cb-9921-460c59c44791" Name="pcalua.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 573 |       <Conditions>
 574 |         <FileHashCondition>
 575 |           <FileHash Type="SHA256" Data="0xB7A4B807D0F9A3088BDEF14DA6B251E532CFC10239C89C9FD6B27CDF3B5125E1" SourceFileName="pcalua.exe" SourceFileLength="73728" />
 576 |         </FileHashCondition>
 577 |       </Conditions>
 578 |     </FileHashRule>
 579 |     <FilePublisherRule Id="2d31e302-64c8-46d6-a37c-b4516efdcd35" Name="PCWRUN.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 580 |       <Conditions>
 581 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PCWRUN.EXE">
 582 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 583 |         </FilePublisherCondition>
 584 |       </Conditions>
 585 |     </FilePublisherRule>
 586 |     <FilePublisherRule Id="42db862c-19a4-42be-975c-c7dcceca89c1" Name="PKTMON.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 587 |       <Conditions>
 588 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PKTMON.EXE">
 589 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 590 |         </FilePublisherCondition>
 591 |       </Conditions>
 592 |     </FilePublisherRule>
 593 |     <FilePublisherRule Id="0733c300-7fc8-47ee-9428-778ab4b835e2" Name="PNPUTIL.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 594 |       <Conditions>
 595 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PNPUTIL.EXE">
 596 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 597 |         </FilePublisherCondition>
 598 |       </Conditions>
 599 |     </FilePublisherRule>
 600 |     <FilePublisherRule Id="bfe5e2b3-a2c6-4112-abfe-7f257e6a5ecc" Name="PRESENTATIONHOST.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 601 |       <Conditions>
 602 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PRESENTATIONHOST.EXE">
 603 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 604 |         </FilePublisherCondition>
 605 |       </Conditions>
 606 |     </FilePublisherRule>
 607 |     <FilePublisherRule Id="a595497b-9abe-4f6f-bdb2-7a2e32a403b4" Name="PRINT.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 608 |       <Conditions>
 609 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PRINT.EXE">
 610 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 611 |         </FilePublisherCondition>
 612 |       </Conditions>
 613 |     </FilePublisherRule>
 614 |     <FilePublisherRule Id="85ebc3f4-f100-4b59-ab1c-867bb66a1128" Name="PRINTBRM.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 615 |       <Conditions>
 616 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PRINTBRM.EXE">
 617 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 618 |         </FilePublisherCondition>
 619 |       </Conditions>
 620 |     </FilePublisherRule>
 621 |     <FilePublisherRule Id="48453db8-6d8d-44e9-ba4f-e212c3d01462" Name="PSR.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 622 |       <Conditions>
 623 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="PSR.EXE">
 624 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 625 |         </FilePublisherCondition>
 626 |       </Conditions>
 627 |     </FilePublisherRule>
 628 |     <FilePublisherRule Id="ec5db4fb-4292-43c3-a937-1180d1724321" Name="RASDLUI.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 629 |       <Conditions>
 630 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="RASDLUI.EXE">
 631 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 632 |         </FilePublisherCondition>
 633 |       </Conditions>
 634 |     </FilePublisherRule>
 635 |     <FilePublisherRule Id="ed9815f0-9f4f-46bf-a404-355a074988dd" Name="RDRLEAKDIAG.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 636 |       <Conditions>
 637 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="RDRLEAKDIAG.EXE">
 638 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 639 |         </FilePublisherCondition>
 640 |       </Conditions>
 641 |     </FilePublisherRule>
 642 |     <FilePublisherRule Id="0612bb4a-9fbe-4d57-81b8-ecf91d410385" Name="REG.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 643 |       <Conditions>
 644 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="REG.EXE">
 645 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 646 |         </FilePublisherCondition>
 647 |       </Conditions>
 648 |     </FilePublisherRule>
 649 |     <FilePublisherRule Id="76ff3bdf-cb7f-406c-a835-57b51e6c0e60" Name="REGASM.EXE version 2.0.50727.9157 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 650 |       <Conditions>
 651 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="REGASM.EXE">
 652 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 653 |         </FilePublisherCondition>
 654 |       </Conditions>
 655 |     </FilePublisherRule>
 656 |     <FilePublisherRule Id="c013dd57-1a96-4ae0-bd79-8eee3bb0fee0" Name="REGINI.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 657 |       <Conditions>
 658 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="REGINI.EXE">
 659 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 660 |         </FilePublisherCondition>
 661 |       </Conditions>
 662 |     </FilePublisherRule>
 663 |     <FilePublisherRule Id="fbc5a4d5-cc8a-4c63-9f9d-e3c12be6eecf" Name="REGISTER-CIMPROVIDER2.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 664 |       <Conditions>
 665 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="REGISTER-CIMPROVIDER2.EXE">
 666 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 667 |         </FilePublisherCondition>
 668 |       </Conditions>
 669 |     </FilePublisherRule>
 670 |     <FilePublisherRule Id="de420c4b-cf52-4ca6-87d8-922b6e6d5c60" Name="REGSVCS.EXE version 2.0.50727.9157 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 671 |       <Conditions>
 672 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="REGSVCS.EXE">
 673 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 674 |         </FilePublisherCondition>
 675 |       </Conditions>
 676 |     </FilePublisherRule>
 677 |     <FilePublisherRule Id="460ccee8-090c-4f13-8ec6-17f5775d9867" Name="REGSVCS.EXE version 4.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 678 |       <Conditions>
 679 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="REGSVCS.EXE">
 680 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 681 |         </FilePublisherCondition>
 682 |       </Conditions>
 683 |     </FilePublisherRule>
 684 |     <FilePublisherRule Id="6b815011-af31-4bf0-a97b-d7784656c232" Name="REGSVR32.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 685 |       <Conditions>
 686 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="REGSVR32.EXE">
 687 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 688 |         </FilePublisherCondition>
 689 |       </Conditions>
 690 |     </FilePublisherRule>
 691 |     <FilePublisherRule Id="535036ab-fa79-45da-abc4-2b2186b01d98" Name="REPLACE.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 692 |       <Conditions>
 693 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="REPLACE.EXE">
 694 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 695 |         </FilePublisherCondition>
 696 |       </Conditions>
 697 |     </FilePublisherRule>
 698 |     <FilePublisherRule Id="b1a07820-64bd-47b0-96c2-b1d09e774a18" Name="RPCPING.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 699 |       <Conditions>
 700 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="RPCPING.EXE">
 701 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 702 |         </FilePublisherCondition>
 703 |       </Conditions>
 704 |     </FilePublisherRule>
 705 |     <FilePublisherRule Id="fdbc3300-2adf-4c03-8b11-48ded4907ecc" Name="RUNDLL32.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 706 |       <Conditions>
 707 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="RUNDLL32.EXE">
 708 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 709 |         </FilePublisherCondition>
 710 |       </Conditions>
 711 |     </FilePublisherRule>
 712 |     <FileHashRule Id="cfa31a3e-794e-4865-a411-7b03461e4f04" Name="runexehelper.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 713 |       <Conditions>
 714 |         <FileHashCondition>
 715 |           <FileHash Type="SHA256" Data="0x9864A809DB1439A90AFC9B4E8046FADCC95B4466CD24F5AF370CDD4B7C45E1F3" SourceFileName="runexehelper.exe" SourceFileLength="77824" />
 716 |         </FileHashCondition>
 717 |       </Conditions>
 718 |     </FileHashRule>
 719 |     <FilePublisherRule Id="56341e61-b820-4047-9c87-a7043604ea80" Name="RUNONCE.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 720 |       <Conditions>
 721 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="RUNONCE.EXE">
 722 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 723 |         </FilePublisherCondition>
 724 |       </Conditions>
 725 |     </FilePublisherRule>
 726 |     <FilePublisherRule Id="3f603396-ef74-4664-b124-9a85a68e1c0c" Name="SCHTASKS.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 727 |       <Conditions>
 728 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="SCHTASKS.EXE">
 729 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 730 |         </FilePublisherCondition>
 731 |       </Conditions>
 732 |     </FilePublisherRule>
 733 |     <FilePublisherRule Id="520f2af6-9987-415b-956e-6b0a025ed4b1" Name="SCRIPTRUNNER.EXE version 10.0.22000.71 exactly in MICROSOFT (R) WINDOWS (R) OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 734 |       <Conditions>
 735 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT (R) WINDOWS (R) OPERATING SYSTEM" BinaryName="SCRIPTRUNNER.EXE">
 736 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 737 |         </FilePublisherCondition>
 738 |       </Conditions>
 739 |     </FilePublisherRule>
 740 |     <FileHashRule Id="3802d4b7-ffae-4d90-9952-e7da1bf00498" Name="ssh.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 741 |       <Conditions>
 742 |         <FileHashCondition>
 743 |           <FileHash Type="SHA256" Data="0x16D3E1FD162AADF12134C7E8A976C979AE175821C8FC5B822BD31CA80CEC44F6" SourceFileName="ssh.exe" SourceFileLength="946176" />
 744 |         </FileHashCondition>
 745 |       </Conditions>
 746 |     </FileHashRule>
 747 |     <FilePublisherRule Id="d397468d-f816-4190-a3eb-de2be76fed93" Name="STORDIAG_MANAGED.EXE version 10.0.22000.1 exactly in MICROSOFT (R) WINDOWS (R) OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 748 |       <Conditions>
 749 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT (R) WINDOWS (R) OPERATING SYSTEM" BinaryName="STORDIAG_MANAGED.EXE">
 750 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 751 |         </FilePublisherCondition>
 752 |       </Conditions>
 753 |     </FilePublisherRule>
 754 |     <FilePublisherRule Id="e98f4b93-ca1f-4d2e-9be9-e975e489fb04" Name="SYNCAPPVPUBLISHINGSERVER.EXE version 10.0.22000.71 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 755 |       <Conditions>
 756 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="SYNCAPPVPUBLISHINGSERVER.EXE">
 757 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 758 |         </FilePublisherCondition>
 759 |       </Conditions>
 760 |     </FilePublisherRule>
 761 |     <FilePublisherRule Id="d3a43633-5a3c-4acf-94db-0d4c7cd7e62e" Name="TTDINJECT.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 762 |       <Conditions>
 763 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="TTDINJECT.EXE">
 764 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 765 |         </FilePublisherCondition>
 766 |       </Conditions>
 767 |     </FilePublisherRule>
 768 |     <FilePublisherRule Id="b26b370a-cc03-4ae9-a5c4-119a8866a228" Name="TTTRACER.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 769 |       <Conditions>
 770 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="TTTRACER.EXE">
 771 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 772 |         </FilePublisherCondition>
 773 |       </Conditions>
 774 |     </FilePublisherRule>
 775 |     <FilePublisherRule Id="cf09ec46-0f78-4953-bca2-1032c05351a0" Name="UNREGMP2.EXE version 12.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 776 |       <Conditions>
 777 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="UNREGMP2.EXE">
 778 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 779 |         </FilePublisherCondition>
 780 |       </Conditions>
 781 |     </FilePublisherRule>
 782 |     <FilePublisherRule Id="ff769792-24e1-4fe2-9021-d082738e1522" Name="VBC.EXE version 14.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 783 |       <Conditions>
 784 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="VBC.EXE">
 785 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 786 |         </FilePublisherCondition>
 787 |       </Conditions>
 788 |     </FilePublisherRule>
 789 |     <FilePublisherRule Id="6207fe50-1606-4851-bbbe-b96dbe5efc13" Name="VERCLSID.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 790 |       <Conditions>
 791 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="VERCLSID.EXE">
 792 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 793 |         </FilePublisherCondition>
 794 |       </Conditions>
 795 |     </FilePublisherRule>
 796 |     <FilePublisherRule Id="80a837cd-42ef-4c6f-8ff2-237149b93960" Name="WAB.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 797 |       <Conditions>
 798 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WAB.EXE">
 799 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 800 |         </FilePublisherCondition>
 801 |       </Conditions>
 802 |     </FilePublisherRule>
 803 |     <FilePublisherRule Id="63bfc180-9923-418e-9126-25ca81da7ef2" Name="WLRMNDR.EXE version 10.0.22000.120 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 804 |       <Conditions>
 805 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WLRMNDR.EXE">
 806 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 807 |         </FilePublisherCondition>
 808 |       </Conditions>
 809 |     </FilePublisherRule>
 810 |     <FilePublisherRule Id="5b41fd70-4dc6-4d7b-a93d-411b15ee9679" Name="WORKFOLDERS.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 811 |       <Conditions>
 812 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WORKFOLDERS.EXE">
 813 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 814 |         </FilePublisherCondition>
 815 |       </Conditions>
 816 |     </FilePublisherRule>
 817 |     <FilePublisherRule Id="50149444-c24c-480b-a1ab-8a2052c415b0" Name="WSRESET.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 818 |       <Conditions>
 819 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WSRESET.EXE">
 820 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 821 |         </FilePublisherCondition>
 822 |       </Conditions>
 823 |     </FilePublisherRule>
 824 |     <FilePublisherRule Id="2de45485-19b9-4939-a4ba-f1975c11ac3c" Name="WUAUCLT.EXE version 10.0.22000.194 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 825 |       <Conditions>
 826 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WUAUCLT.EXE">
 827 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 828 |         </FilePublisherCondition>
 829 |       </Conditions>
 830 |     </FilePublisherRule>
 831 |     <FilePublisherRule Id="54559730-2b0e-443b-994c-a5e2dd7e9ce5" Name="XWIZARD.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 832 |       <Conditions>
 833 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="XWIZARD.EXE">
 834 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 835 |         </FilePublisherCondition>
 836 |       </Conditions>
 837 |     </FilePublisherRule>     
 838 |     <!--LOLBAS rules added above ^-->
 839 |     <!--MS recommended block rules added below V-->
 840 |     <FilePublisherRule Id="5e55bb99-00ae-48d7-9e8d-f95eab3d22c1" Name="ADDINPROCESS.EXE version 3.5.30729.9151 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 841 |       <Conditions>
 842 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="ADDINPROCESS.EXE">
 843 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 844 |         </FilePublisherCondition>
 845 |       </Conditions>
 846 |     </FilePublisherRule>
 847 |     <FilePublisherRule Id="10428f33-b9f0-4a59-b3b4-43f15e0e5e86" Name="ADDINPROCESS32.EXE version 3.5.30729.9151 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 848 |       <Conditions>
 849 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="ADDINPROCESS32.EXE">
 850 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 851 |         </FilePublisherCondition>
 852 |       </Conditions>
 853 |     </FilePublisherRule>
 854 |     <FilePublisherRule Id="b2c2a716-bf16-4498-8b05-218217004dd3" Name="ADDINUTIL.EXE version 3.5.30729.9151 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 855 |       <Conditions>
 856 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="ADDINUTIL.EXE">
 857 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 858 |         </FilePublisherCondition>
 859 |       </Conditions>
 860 |     </FilePublisherRule>
 861 |     <FilePublisherRule Id="06feb920-3849-4bec-a29e-7b0ccc2adcc0" Name="ASPNET_COMPILER.EXE version 2.0.50727.9157 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 862 |       <Conditions>
 863 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="ASPNET_COMPILER.EXE">
 864 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 865 |         </FilePublisherCondition>
 866 |       </Conditions>
 867 |     </FilePublisherRule>
 868 |     <FileHashRule Id="033351b6-6f11-4d7c-8be1-a21456ad9bfe" Name="bash.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 869 |       <Conditions>
 870 |         <FileHashCondition>
 871 |           <FileHash Type="SHA256" Data="0x11DF26E05ECE92B1C57EBC6EB4224A11B81955A6B9781AAB8CFFF63BE4713336" SourceFileName="bash.exe" SourceFileLength="43070" />
 872 |         </FileHashCondition>
 873 |       </Conditions>
 874 |     </FileHashRule>
 875 |     <FilePublisherRule Id="0ebd1f45-271c-4ea9-9f9a-8830336966ec" Name="CSCRIPT.EXE version 5.812.10240.16384 exactly in MICROSOFT ® WINDOWS SCRIPT HOST from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 876 |       <Conditions>
 877 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT ® WINDOWS SCRIPT HOST" BinaryName="CSCRIPT.EXE">
 878 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 879 |         </FilePublisherCondition>
 880 |       </Conditions>
 881 |     </FilePublisherRule>
 882 |     <FilePublisherRule Id="326f6378-0ba5-4dc8-9967-0963aaefb7f2" Name="INFDEFAULTINSTALL.EXE version 5.2.3668.0 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 883 |       <Conditions>
 884 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="INFDEFAULTINSTALL.EXE">
 885 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 886 |         </FilePublisherCondition>
 887 |       </Conditions>
 888 |     </FilePublisherRule>
 889 |     <!-- generated KILL.EXE rule by downloading windows debugging tools and getting information from there. Kill not actually present on current systems-->
 890 |     <FilePublisherRule Id="44e50f01-5279-4286-b140-bdbab33bf3ac" Name="KILL.EXE version 10.0.22621.755 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM  from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action=Deny>
 891 |       <Conditions>
 892 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="KILL.EXE">
 893 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 894 |         </FilePublisherCondition>
 895 |       </Conditions>
 896 |     </FilePublisherRule>
 897 |     <FilePublisherRule Id="e41a0074-d29b-437d-9739-468f7c11501a" Name="MICROSOFT.WORKFLOW.COMPILER.EXE version 4.8.4161.0 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 898 |       <Conditions>
 899 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="MICROSOFT.WORKFLOW.COMPILER.EXE">
 900 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 901 |         </FilePublisherCondition>
 902 |       </Conditions>
 903 |     </FilePublisherRule>
 904 |     <FilePublisherRule Id="67a731cc-70be-4363-a46c-9d4ce220dc8c" Name="MSBUILD.EXE version 3.5.30729.9151 exactly in MICROSOFT® .NET FRAMEWORK from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 905 |       <Conditions>
 906 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® .NET FRAMEWORK" BinaryName="MSBUILD.EXE">
 907 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 908 |         </FilePublisherCondition>
 909 |       </Conditions>
 910 |     </FilePublisherRule>
 911 |     <FilePublisherRule Id="5af99c4b-d376-4fd7-a090-9726b53e306d" Name="MSHTA.EXE version 11.0.22000.1 exactly in INTERNET EXPLORER from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 912 |       <Conditions>
 913 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="INTERNET EXPLORER" BinaryName="MSHTA.EXE">
 914 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 915 |         </FilePublisherCondition>
 916 |       </Conditions>
 917 |     </FilePublisherRule>
 918 |     <FilePublisherRule Id="dc8d2249-86c0-4753-8e6f-72224b4b349a" Name="WMIC.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 919 |       <Conditions>
 920 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WMIC.EXE">
 921 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 922 |         </FilePublisherCondition>
 923 |       </Conditions>
 924 |     </FilePublisherRule>
 925 |     <FilePublisherRule Id="2ae31f02-a99f-48e4-8309-f63ede7b0e69" Name="WSCRIPT.EXE version 5.812.10240.16384 exactly in MICROSOFT ® WINDOWS SCRIPT HOST from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 926 |       <Conditions>
 927 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT ® WINDOWS SCRIPT HOST" BinaryName="WSCRIPT.EXE">
 928 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 929 |         </FilePublisherCondition>
 930 |       </Conditions>
 931 |     </FilePublisherRule>
 932 |     <FilePublisherRule Id="c84dfdad-582a-445e-a6ed-3f894ceaa640" Name="WSL.EXE version 10.0.22000.1 exactly in MICROSOFT® WINDOWS® OPERATING SYSTEM from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 933 |       <Conditions>
 934 |         <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="WSL.EXE">
 935 |           <BinaryVersionRange LowSection="*" HighSection="*" />
 936 |         </FilePublisherCondition>
 937 |       </Conditions>
 938 |     </FilePublisherRule>
 939 |     <FileHashRule Id="c2a00d77-0eae-4dcc-b81e-39c8f02e5d00" Name="wslconfig.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 940 |       <Conditions>
 941 |         <FileHashCondition>
 942 |           <FileHash Type="SHA256" Data="0x94FFAA6C9E6F84F093C17E772BAC136D013E9B9E9981817D44C1A8B7FBBDFF42" SourceFileName="wslconfig.exe" SourceFileLength="43054" />
 943 |         </FileHashCondition>
 944 |       </Conditions>
 945 |     </FileHashRule>
 946 |     <FileHashRule Id="873d98f6-5f26-446f-8022-3adfe194283f" Name="wslhost.exe" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
 947 |       <Conditions>
 948 |         <FileHashCondition>
 949 |           <FileHash Type="SHA256" Data="0xB96724138F3E49E9AB9BBE4A3BA8583DDE225D09207090C8927A588B6BA19C9E" SourceFileName="wslhost.exe" SourceFileLength="57202" />
 950 |         </FileHashCondition>
 951 |       </Conditions>
 952 |     </FileHashRule>
 953 |     <!--MS Recommended Block Rules added above ^-->
 954 |   </RuleCollection>
 955 |   <RuleCollection Type="Msi" EnforcementMode="AuditOnly">
 956 |     <FilePathRule Id="4833728f-cf7e-4797-a847-c979e29b597a" Name="Allow administrators to run all Windows Installer files" Description="Allows members of the local Administrators group to run all Windows Installer files." UserOrGroupSid="S-1-5-32-544" Action="Allow">
 957 |       <Conditions>
 958 |         <FilePathCondition Path="*" />
 959 |       </Conditions>
 960 |     </FilePathRule>
 961 | 	<FilePathRule Id="0b075828-da4a-41fc-b3b4-9ac83ad18add" Name="Allow everyone to run all Windows Installer files located in the Windows\Installer folder." Description="Allows members of the Everyone group to run all Windows Installer files located in %systemdrive%\Windows\Installer." UserOrGroupSid="S-1-1-0" Action="Allow">
 962 |       <Conditions>
 963 |         <FilePathCondition Path="%WINDIR%\Installer\*" />
 964 |       </Conditions>
 965 |     </FilePathRule>   
 966 |   </RuleCollection>
 967 |   <RuleCollection Type="Script" EnforcementMode="AuditOnly">
 968 |     <FilePathRule Id="ed97d0cb-15ff-430f-b82c-8d7832957725" Name="All scripts" Description="Allows members of the local Administrators group to run all scripts." UserOrGroupSid="S-1-5-32-544" Action="Allow">
 969 |       <Conditions>
 970 |         <FilePathCondition Path="*" />
 971 |       </Conditions>
 972 |     </FilePathRule>
 973 | 	<FilePathRule Id="4a4170c6-feb8-44f6-bebf-78a319f197fe" Name="Allow everyone to run all scripts located in the Program Files folder" Description="Allows members of the Everyone group to run scripts that are located in the Program Files folder." UserOrGroupSid="S-1-1-0" Action="Allow">
 974 |       <Conditions>
 975 |         <FilePathCondition Path="%PROGRAMFILES%\*" />
 976 |       </Conditions>
 977 |     </FilePathRule>
 978 |     <FilePathRule Id="8f42d1d3-5f29-469d-8f37-6f01f6c3b2f4" Name="Allow everyone to run all scripts located in the Windows folder" Description="Allows members of the Everyone group to run scripts that are located in the Windows folder." UserOrGroupSid="S-1-1-0" Action="Allow">
 979 |       <Conditions>
 980 |         <FilePathCondition Path="%WINDIR%\*" />
 981 |       </Conditions>
 982 |       <Exceptions>
 983 |         <FilePathCondition Path="%SYSTEM32%\catroot2\*" />
 984 |         <FilePathCondition Path="%SYSTEM32%\com\dmp\*" />
 985 |         <FilePathCondition Path="%SYSTEM32%\FxsTmp\*" />
 986 |         <FilePathCondition Path="%SYSTEM32%\spool\drivers\color\*" />
 987 |         <FilePathCondition Path="%SYSTEM32%\spool\PRINTERS\*" />
 988 |         <FilePathCondition Path="%SYSTEM32%\spool\SERVERS\*" />
 989 |         <FilePathCondition Path="%SYSTEM32%\Tasks\*" />
 990 |         <FilePathCondition Path="%WINDIR%\Debug\*" />
 991 |         <FilePathCondition Path="%WINDIR%\PCHEALTH\ERRORREP\*" />
 992 |         <FilePathCondition Path="%WINDIR%\Registration\*" />
 993 |         <FilePathCondition Path="%WINDIR%\SysWOW64\com\dmp\*" />
 994 |         <FilePathCondition Path="%WINDIR%\SysWOW64\FxsTmp\*" />
 995 |         <FilePathCondition Path="%WINDIR%\SysWOW64\Tasks\*" />
 996 |         <FilePathCondition Path="%WINDIR%\Tasks\*" />
 997 |         <FilePathCondition Path="%WINDIR%\Temp\*" />
 998 |         <FilePathCondition Path="%WINDIR%\tracing\*" />
 999 |       </Exceptions>
1000 |     </FilePathRule>   
1001 |     <!--LOLBAS block rules added below V-->
1002 |     <FileHashRule Id="33eafa57-50ee-4b28-84b8-fb7ddafba6ba" Name="CL_Invocation.ps1" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1003 |       <Conditions>
1004 |         <FileHashCondition>
1005 |           <FileHash Type="SHA256" Data="0x18DC8E1D82DA96068148C42DCCDBFDBB8C58590A6E28E9FB4D7F7B1AB664F5B4" SourceFileName="CL_Invocation.ps1" SourceFileLength="1029" />
1006 |         </FileHashCondition>
1007 |       </Conditions>
1008 |     </FileHashRule>
1009 |     <FileHashRule Id="159ad0c3-ce9c-417e-8453-713990ea1d95" Name="CL_LoadAssembly.ps1" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1010 |       <Conditions>
1011 |         <FileHashCondition>
1012 |           <FileHash Type="SHA256" Data="0x8271203C21B325746A5A439D733EFD3ADE8C326092337643293BFBA9750C534E" SourceFileName="CL_LoadAssembly.ps1" SourceFileLength="610" />
1013 |         </FileHashCondition>
1014 |       </Conditions>
1015 |     </FileHashRule>
1016 |     <FileHashRule Id="73c41820-267a-4bfa-b0aa-ee8cf9cc9214" Name="CL_Mutexverifiers.ps1" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1017 |       <Conditions>
1018 |         <FileHashCondition>
1019 |           <FileHash Type="SHA256" Data="0xFD6130039ECA7C817A5BEF802B652E9C7A1EFED986E6165960AE62C83A397DCC" SourceFileName="CL_Mutexverifiers.ps1" SourceFileLength="22025" />
1020 |         </FileHashCondition>
1021 |       </Conditions>
1022 |     </FileHashRule>
1023 |     <FileHashRule Id="be0b6276-138b-4887-a4df-66cb7e441905" Name="Pester.bat" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1024 |       <Conditions>
1025 |         <FileHashCondition>
1026 |           <FileHash Type="SHA256" Data="0xEB83A9D837CFE2F409CA3839B017E307A7A65782CB6A0AE0C50731C244DAD40E" SourceFileName="Pester.bat" SourceFileLength="925" />
1027 |         </FileHashCondition>
1028 |       </Conditions>
1029 |     </FileHashRule>
1030 |     <FileHashRule Id="59471087-9ae4-498d-8604-23ec29dcf884" Name="pubprn.vbs" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1031 |       <Conditions>
1032 |         <FileHashCondition>
1033 |           <FileHash Type="SHA256" Data="0x25B64FAC0620BB5B8BB7A886A4D6851784D45127CFB9603C661AD5BCAD4F9AC7" SourceFileName="pubprn.vbs" SourceFileLength="36884" />
1034 |         </FileHashCondition>
1035 |       </Conditions>
1036 |     </FileHashRule>
1037 |     <FileHashRule Id="be4585a9-db4d-43df-878a-84d01128e587" Name="SyncAppvPublishingServer.vbs" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1038 |       <Conditions>
1039 |         <FileHashCondition>
1040 |           <FileHash Type="SHA256" Data="0xB8A5C42BF6F7A14BA73660BE29F5C061D30B41C6D14E42B880A4EA522F43CE66" SourceFileName="SyncAppvPublishingServer.vbs" SourceFileLength="1720" />
1041 |         </FileHashCondition>
1042 |       </Conditions>
1043 |     </FileHashRule>
1044 |     <FileHashRule Id="813134b0-074e-4081-ada3-f006db1d6c93" Name="UtilityFunctions.ps1" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1045 |       <Conditions>
1046 |         <FileHashCondition>
1047 |           <FileHash Type="SHA256" Data="0x3891846307AA9E83BCA66B13198455AF72AF45BF721A2FBD41840D47E2A91201" SourceFileName="UtilityFunctions.ps1" SourceFileLength="54687" />
1048 |         </FileHashCondition>
1049 |       </Conditions>
1050 |     </FileHashRule>
1051 |     <FileHashRule Id="7fa7e5e1-1e10-4f0b-a6e9-3eb5ad44ace0" Name="winrm.vbs" Description="" UserOrGroupSid="S-1-1-0" Action="Deny">
1052 |       <Conditions>
1053 |         <FileHashCondition>
1054 |           <FileHash Type="SHA256" Data="0xAD4AC01243A9775D26945CF742A06ACB03F34056FEE9576D646FF65617BF94F5" SourceFileName="winrm.vbs" SourceFileLength="204074" />
1055 |         </FileHashCondition>
1056 |       </Conditions>
1057 |     </FileHashRule>
1058 |     <!--LOLBAS block rules added above ^-->
1059 |   </RuleCollection>
1060 |   <RuleCollection Type="Appx" EnforcementMode="AuditOnly">
1061 |     <FilePublisherRule Action="Allow" UserOrGroupSid="S-1-1-0" Description="Allows members of the Everyone group to run packaged apps that are signed." Name="(Default Rule) All signed packaged apps" Id="a9e18c21-ff8f-43cf-b9fc-db40eed6936a">
1062 |       <Conditions>
1063 |         <FilePublisherCondition BinaryName="*" ProductName="*" PublisherName="*">
1064 |           <BinaryVersionRange LowSection="0.0.0.0" HighSection="*"/>
1065 |         </FilePublisherCondition>
1066 |       </Conditions>
1067 |     </FilePublisherRule>
1068 |   </RuleCollection>
1069 | </AppLockerPolicy>


--------------------------------------------------------------------------------
/AppLocker Starter Policy/Windows11_AppLocker Starter Policy.xml:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/AppLocker Starter Policy/Windows11_AppLocker Starter Policy.xml


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/AppLocker Event Forwarding Subscription Meta Event Query Filter xml:
--------------------------------------------------------------------------------
1 | When setting up an event forwarding subscription, it is necessary to tell the subscription 
2 | which events are desired for forwarding.  The following event query can be used within an 
3 | event subscription to select the AppLocker Meta Events for forwarding:
4 | 
5 | <QueryList>
6 |   <Query Id="0" Path="AppLocker">
7 |     <Select Path="AppLocker">*[System[(Level=1  or Level=2 or Level=3)]]</Select>
8 |   </Query>
9 | </QueryList>


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/AppLocker Meta Events Custom View.xml:
--------------------------------------------------------------------------------
1 | <!--
2 | This file is an Event Viewer custom query that can be imported to automatically filter and show only 
3 | the AppLocker Meta Events.
4 | -->
5 | <ViewerConfig><QueryConfig><QueryParams><Simple><Level>1,2,3</Level><Channel>AppLocker</Channel><RelativeTimeInfo>0</RelativeTimeInfo><BySource>False</BySource></Simple></QueryParams><QueryNode><Name>AppLocker Meta Events</Name><QueryList><Query Id="0" Path="AppLocker"><Select Path="AppLocker">*[System[(Level=1  or Level=2 or Level=3)]]</Select></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/AppLocker Meta Events grouped by File.ps1:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/Create AppLocker Meta Events/AppLocker Meta Events grouped by File.ps1


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/AppLocker Meta Events to CSV.ps1:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/Create AppLocker Meta Events/AppLocker Meta Events to CSV.ps1


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/Create AppLocker Meta Event Task.bat:
--------------------------------------------------------------------------------
 1 | REM *******************
 2 | REM This script looks up the computer's domain and then registers the "Create AppLocker Meta Event" task 
 3 | REM to trigger when an AppLocker event is created and run a script to create the new AppLocker meta event 
 4 | REM with additional calling process and user information.
 5 | REM 
 6 | REM This script can be pushed out as a computer startup script to create the "Create AppLocker Meta Event" 
 7 | REM task on each computer to trigger when an AppLocker event is created and run a script to create a new 
 8 | REM AppLocker meta event with additional calling process and user information.  This file should be placed 
 9 | REM in the \\<domain>\SYSVOL\<domain>\Scripts file share along with the "Create AppLocker Meta 
10 | REM Event.ps1.txt" powershell script file and the "Create AppLocker Meta Event Task.xml" file in order to 
11 | REM create the task successfully.
12 | REM *******************
13 | 
14 | REM Get domain name
15 | FOR /F "tokens=1* delims=REG_SZ " %%A IN ('REG QUERY HKLM\System\CurrentControlSet\Services\Tcpip\Parameters /v Domain') DO (
16 |   SET COMPUTERDOMAIN=%%B
17 | )
18 | 
19 | schtasks.exe /query /tn "Create AppLocker Meta Event"
20 | IF ERRORLEVEL 1 (
21 |   mkdir C:\Windows\Scripts
22 |   copy /y "\\%COMPUTERDOMAIN%\sysvol\%COMPUTERDOMAIN%\scripts\Create AppLocker Meta Event.ps1" C:\Windows\Scripts
23 |   schtasks.exe /create /tn "Create AppLocker Meta Event" /xml "\\%COMPUTERDOMAIN%\sysvol\%COMPUTERDOMAIN%\scripts\Create AppLocker Meta Event Task.xml"
24 | )
25 | 


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/Create AppLocker Meta Event Task.xml:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/Create AppLocker Meta Events/Create AppLocker Meta Event Task.xml


--------------------------------------------------------------------------------
/Create AppLocker Meta Events/Create AppLocker Meta Event.ps1:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/Create AppLocker Meta Events/Create AppLocker Meta Event.ps1


--------------------------------------------------------------------------------
/Create AppLocker Popup Task/AppLocker Popup Alert Task.xml:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/Create AppLocker Popup Task/AppLocker Popup Alert Task.xml


--------------------------------------------------------------------------------
/Create AppLocker Popup Task/Create AppLocker Popup Task.bat:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/nsacyber/AppLocker-Guidance/f04b3c3d2c3b2dad6048bb898f11bffcb567d8cc/Create AppLocker Popup Task/Create AppLocker Popup Task.bat


--------------------------------------------------------------------------------
/DISCLAIMER.md:
--------------------------------------------------------------------------------
1 | ## Disclaimer of Warranty
2 | This Work is provided "as is". Any express or implied warranties, including but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the United States Government be liable for any direct, indirect, incidental, special, exemplary or consequential damages (including, but not limited to, procurement of substitute goods or services, loss of use, data or profits, or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this Work, even if advised of the possibility of such damage.
3 | 
4 | The User of this Work agrees to hold harmless and indemnify the United States Government, its agents and employees from every claim or liability (whether in tort or in contract), including attorneys' fees, court costs, and expenses, arising in direct consequence of Recipient's use of the item, including but not limited to, claims or liabilities made for injury to or death of personnel of User or third parties, damage to or destruction of property of User or third parties, infringement or other violations of intellectual property or technical data rights.
5 | 
6 | Nothing in this Work is intended to constitute an endorsement, explicit or implied, by the United States Government of any particular manufacturer's product or service.
7 | 
8 | ## Disclaimer of Endorsement
9 | Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, in this Work does not constitute an endorsement, recommendation, or favoring by the United States Government and shall not be used for advertising or product endorsement purposes.


--------------------------------------------------------------------------------
/Event Viewer AppLocker Custom View/AppLocker Event Viewer Custom View.xml:
--------------------------------------------------------------------------------
1 | <!--
2 | This file is an Event Viewer custom view that can be imported to automatically filter and show only 
3 | the AppLocker warning and error events.
4 | -->
5 | <ViewerConfig><QueryConfig><QueryParams><Simple><BySource>True</BySource><Channel>Microsoft-Windows-AppLocker/EXE and DLL,Microsoft-Windows-AppLocker/MSI and Script</Channel><Source>Microsoft-Windows-AppLocker</Source><RelativeTimeInfo>0</RelativeTimeInfo><Level>1,2,3</Level></Simple></QueryParams><QueryNode><Name>AppLocker Warnings and Errors</Name><Description>AppLocker Warnings and Errors Custom View</Description><QueryList><Query Id="0" Path="Microsoft-Windows-AppLocker/EXE and DLL"><Select Path="Microsoft-Windows-AppLocker/EXE and DLL">*[System[Provider[@Name='Microsoft-Windows-AppLocker'] and (Level=1  or Level=2 or Level=3)]]</Select><Select Path="Microsoft-Windows-AppLocker/MSI and Script">*[System[Provider[@Name='Microsoft-Windows-AppLocker'] and (Level=1  or Level=2 or Level=3)]]</Select></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>


--------------------------------------------------------------------------------
/LICENSE.md:
--------------------------------------------------------------------------------
1 | This Work was prepared by a United States Government employee and, therefore, is excluded from copyright by Section 105 of the Copyright Act of 1976.
2 | 
3 | Copyright and Related Rights in the Work worldwide are waived through the [CC0 1.0 Universal license](https://creativecommons.org/publicdomain/zero/1.0/).


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # AppLocker Guidance
 2 | 
 3 | Microsoft AppLocker is an application control feature built into Windows. Application control is one of [Information Assurance top 10 mitigation strategies](https://media.defense.gov/2019/Jul/16/2002158046/-1/-1/0/DDD-190716-666-071.PDF).
 4 | 
 5 | This project contains scripts and configuration files for aiding administrators in implementing Microsoft AppLocker as outlined in the Application Control using Microsoft AppLocker paper. 
 6 | 
 7 | **The starter policy provided in this repository is for Windows 11**. 
 8 | 
 9 | ## Guidance
10 | NSA Information Assurance has a security guide for AppLocker called Application Control Using Microsoft AppLocker. For more detailed instructions and additional information, please see the [wiki](https://github.com/nsacyber/AppLocker-Guidance/wiki).  
11 | 
12 | ## Addressing Living Off the Land Binaries and Scripts (LOLBAS)
13 | For the past several years, Living Off the Land techniques have been seeing an increase in usage by threat actors. These techniques often utilize binaries, scripts, and libraries that come pre installed on Windows or see high usage on most Windows systems, which allow threat actors to operate very stealthily in those environments. LOLBAS threats can be partially mitigated using Applocker or other application control solutions. To that end, The security community has created and maintains a repository of well known LOLBAS, called the LOLBAS Project, to help defenders and admins be aware and to develop application control policies addressing LOLBAS. Microsoft has additionally put out a list of binaries that they recommend be blocked due to frequent abuse. The default policies within this repository have been updated with explicit deny rules for the respective LOLBAS and MS recommendations, but administrators should still evaluate their own networks for usage of LOLBAS and adjust the AppLocker policies accordingly.
14 | 
15 | ## Resources
16 | 
17 | * [AppLocker Technical Reference](https://learn.microsoft.com/en-us/windows/device-security/applocker/applocker-technical-reference)
18 | * [Requirements to use AppLocker](https://learn.microsoft.com/en-us/windows/device-security/applocker/requirements-to-use-applocker)
19 | * [AppLocker Policies Deployment Guide](https://learn.microsoft.com/en-us/windows/device-security/applocker/applocker-policies-deployment-guide)
20 | * [Microsoft Recommended Block Rules for WDAC](https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules)
21 | * [Living Off the Land Binaries, Scripts, and Libraries](https://lolbas-project.github.io/)
22 | 
23 | ## License
24 | See [LICENSE](LICENSE.md).
25 | 
26 | ## Disclaimer
27 | See [DISCLAIMER](DISCLAIMER.md).
28 | 


--------------------------------------------------------------------------------