<?xml version="1.0" encoding="utf-8"?>
<!--
  WDAC supplemental file-rule set: deny common LOLBIN execution.

  Designed to be MERGED with:
    %SystemRoot%\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml
    (Microsoft Recommended Block Rules - merged optionally via Build script)

  Match key: <FileRule FileName="X"> matches the PE's OriginalFileName field,
  not the path on disk. An attacker who copies certutil.exe to certutil-renamed.exe
  is still blocked because the embedded OriginalFileName is "CertUtil.exe".

  This XML alone is NOT deployable. The Build-WDACStarter.ps1 script merges it
  with the OS-shipped Windows base template so Microsoft-signed code keeps
  running (this file does not declare allow rules).

  Conservative tier only. Aggressive additions (cscript/wscript/msbuild/csc)
  are commented out at the bottom - uncomment after audit-mode validation.
-->
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>1.0.0.0</VersionEx>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <PolicyID>{B1F2E3D4-5A6B-7C8D-9E0F-1234567890AB}</PolicyID>
  <BasePolicyID>{B1F2E3D4-5A6B-7C8D-9E0F-1234567890AB}</BasePolicyID>

  <Rules>
    <Rule><Option>Enabled:Unsigned System Integrity Policy</Option></Rule>
    <Rule><Option>Enabled:Audit Mode</Option></Rule>
    <Rule><Option>Enabled:Advanced Boot Options Menu</Option></Rule>
    <Rule><Option>Required:Enforce Store Applications</Option></Rule>
    <Rule><Option>Enabled:UMCI</Option></Rule>
    <Rule><Option>Disabled:Script Enforcement</Option></Rule>
    <Rule><Option>Enabled:Update Policy No Reboot</Option></Rule>
    <Rule><Option>Enabled:Allow Supplemental Policies</Option></Rule>
  </Rules>

  <EKUs />

  <FileRules>
    <!-- Downloaders / file-stagers -->
    <Deny ID="ID_DENY_CERTUTIL"   FriendlyName="certutil.exe"    FileName="CertUtil.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_BITSADMIN"  FriendlyName="bitsadmin.exe"   FileName="bitsadmin.exe"  MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_ESENTUTL"   FriendlyName="esentutl.exe"    FileName="esentutl.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_EXPAND"     FriendlyName="expand.exe"      FileName="expand.exe"     MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_EXTRAC32"   FriendlyName="extrac32.exe"    FileName="extrac32.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_MAKECAB"    FriendlyName="makecab.exe"     FileName="makecab.exe"    MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_REPLACE"    FriendlyName="replace.exe"     FileName="replace.exe"    MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_PRINT"      FriendlyName="print.exe"       FileName="print.exe"      MinimumFileVersion="0.0.0.0" />

    <!-- Script host / dynamic execution -->
    <Deny ID="ID_DENY_MSHTA"      FriendlyName="mshta.exe"            FileName="MSHTA.EXE"               MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_HH"         FriendlyName="hh.exe"               FileName="HH.exe"                  MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_IEEXEC"     FriendlyName="ieexec.exe"           FileName="IEExec.exe"              MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_PRSHOST"    FriendlyName="presentationhost.exe" FileName="PresentationHost.exe"    MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_SAPVS"      FriendlyName="syncappvpublishingserver.exe" FileName="SyncAppvPublishingServer.exe" MinimumFileVersion="0.0.0.0" />

    <!-- Deprecated / legacy runtime helpers -->
    <Deny ID="ID_DENY_WMIC"       FriendlyName="wmic.exe"        FileName="wmic.exe"       MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_PCALUA"     FriendlyName="pcalua.exe"      FileName="PcaLua.exe"     MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_PCWRUN"     FriendlyName="pcwrun.exe"      FileName="PcwRun.exe"     MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_XWIZARD"    FriendlyName="xwizard.exe"     FileName="xwizard.exe"    MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_VERCLSID"   FriendlyName="verclsid.exe"    FileName="verclsid.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_FORFILES"   FriendlyName="forfiles.exe"    FileName="forfiles.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_IE4UINIT"   FriendlyName="ie4uinit.exe"    FileName="ie4uinit.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_SCRIPTRUN"  FriendlyName="scriptrunner.exe" FileName="ScriptRunner.exe" MinimumFileVersion="0.0.0.0" />

    <!-- .NET install / register helpers -->
    <Deny ID="ID_DENY_INSTUTIL"   FriendlyName="installutil.exe" FileName="InstallUtil.exe" MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_REGASM"     FriendlyName="regasm.exe"      FileName="RegAsm.exe"     MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_REGSVCS"    FriendlyName="regsvcs.exe"     FileName="RegSvcs.exe"    MinimumFileVersion="0.0.0.0" />

    <!-- PowerShell ISE -->
    <Deny ID="ID_DENY_PSISE"      FriendlyName="powershell_ise.exe" FileName="PowerShell_ISE.EXE" MinimumFileVersion="0.0.0.0" />

    <!-- AGGRESSIVE TIER - uncomment after Audit-mode validation -->
    <!--
    <Deny ID="ID_DENY_CSCRIPT"    FriendlyName="cscript.exe"   FileName="cscript.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_WSCRIPT"    FriendlyName="wscript.exe"   FileName="wscript.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_MSBUILD"    FriendlyName="msbuild.exe"   FileName="MSBuild.exe"   MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_CSC"        FriendlyName="csc.exe"       FileName="csc.exe"       MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_VBC"        FriendlyName="vbc.exe"       FileName="vbc.exe"       MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_CMSTP"      FriendlyName="cmstp.exe"     FileName="CMSTP.EXE"     MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_MSDT"       FriendlyName="msdt.exe"      FileName="msdt.exe"      MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_MAVINJECT"  FriendlyName="mavinject.exe" FileName="mavinject.exe" MinimumFileVersion="0.0.0.0" />
    <Deny ID="ID_DENY_ODBCCONF"   FriendlyName="odbcconf.exe"  FileName="odbcconf.exe"  MinimumFileVersion="0.0.0.0" />
    -->
  </FileRules>

  <Signers />

  <SigningScenarios>
    <!-- 12 = User-mode code integrity -->
    <SigningScenario Value="12" ID="ID_SIGNINGSCENARIO_WINDOWS" FriendlyName="LOLBIN denies (user-mode)">
      <ProductSigners>
        <FileRulesRef>
          <FileRuleRef RuleID="ID_DENY_CERTUTIL" />
          <FileRuleRef RuleID="ID_DENY_BITSADMIN" />
          <FileRuleRef RuleID="ID_DENY_ESENTUTL" />
          <FileRuleRef RuleID="ID_DENY_EXPAND" />
          <FileRuleRef RuleID="ID_DENY_EXTRAC32" />
          <FileRuleRef RuleID="ID_DENY_MAKECAB" />
          <FileRuleRef RuleID="ID_DENY_REPLACE" />
          <FileRuleRef RuleID="ID_DENY_PRINT" />
          <FileRuleRef RuleID="ID_DENY_MSHTA" />
          <FileRuleRef RuleID="ID_DENY_HH" />
          <FileRuleRef RuleID="ID_DENY_IEEXEC" />
          <FileRuleRef RuleID="ID_DENY_PRSHOST" />
          <FileRuleRef RuleID="ID_DENY_SAPVS" />
          <FileRuleRef RuleID="ID_DENY_WMIC" />
          <FileRuleRef RuleID="ID_DENY_PCALUA" />
          <FileRuleRef RuleID="ID_DENY_PCWRUN" />
          <FileRuleRef RuleID="ID_DENY_XWIZARD" />
          <FileRuleRef RuleID="ID_DENY_VERCLSID" />
          <FileRuleRef RuleID="ID_DENY_FORFILES" />
          <FileRuleRef RuleID="ID_DENY_IE4UINIT" />
          <FileRuleRef RuleID="ID_DENY_SCRIPTRUN" />
          <FileRuleRef RuleID="ID_DENY_INSTUTIL" />
          <FileRuleRef RuleID="ID_DENY_REGASM" />
          <FileRuleRef RuleID="ID_DENY_REGSVCS" />
          <FileRuleRef RuleID="ID_DENY_PSISE" />
        </FileRulesRef>
      </ProductSigners>
    </SigningScenario>
  </SigningScenarios>

  <UpdatePolicySigners />
  <CiSigners />
  <HvciOptions>0</HvciOptions>

  <Settings>
    <Setting Provider="PolicyInfo" Key="Information" ValueName="Name">
      <Value><String>WDAC-Starter-LOLBIN-Audit</String></Value>
    </Setting>
    <Setting Provider="PolicyInfo" Key="Information" ValueName="Id">
      <Value><String>STARTER-LOLBIN-AUDIT-001</String></Value>
    </Setting>
  </Settings>
</SiPolicy>
