Windows LOLBIN Hardening

Entry Point: LOLBIN Exposure Assessment

What we check

• Windows edition coverage — WDAC requires Pro / Enterprise / Server 2019+. Home edition gets ACL stopgap only.
• Existing application-control posture — AppLocker policies, SmartScreen, Defender Exploit Guard ASR rules.
• SYSTEM-context dependencies — scheduled tasks, services, and update flows that legitimately invoke binaries on the candidate deny-list.
• Recent LOLBIN telemetry — what's actually running on these hosts right now (process events, command-line auditing).
• Backup / rollback capacity — can we revert in <15 minutes if a deny rule breaks a production workload?

Quick Telemetry Pull

# What's invoked LOLBIN-style on this host in the last 30 days?
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4688;StartTime=(Get-Date).AddDays(-30)} |
  Where-Object { $_.Properties[5].Value -match 'certutil|bitsadmin|mshta|wmic|regsvr32|installutil|msbuild|cscript|wscript|hh\.exe|forfiles|esentutl' } |
  Select-Object TimeCreated,
    @{n='Process';e={$_.Properties[5].Value}},
    @{n='Parent'; e={$_.Properties[13].Value}},
    @{n='User';   e={$_.Properties[1].Value}} |
  Group-Object Process | Sort-Object Count -Descending |
  Select-Object Count, Name

# Is WDAC supported on this build?
(Get-ComputerInfo -Property OsName, OsBuildNumber, WindowsEditionId).WindowsEditionId
# Pro/Enterprise/Server SKUs only

Output

One-page exposure scorecard: dormant LOLBINs (safe to deny tonight), in-use LOLBINs (audit-mode required first), unsupported hosts (ACL-only). Prioritized 4-week rollout plan.

• Run the Restrict-LOLBINs-SYSTEM.ps1 in dry-run on every Windows host. It enumerates the conservative LOLBIN list (25 binaries) and writes a JSON SDDL backup before any change.
  15 min/hostFree
• Apply on one test VM with -Apply. Verify SYSTEM-context launch of certutil.exe fails (use PsExec -i -s to test).
  30 minFree
• Document the rollback command and store the SDDL backup JSON in your IR vault — if a service breaks at 2 AM, on-call needs to revert in <5 min.
  15 minFree
• Block PowerShell ISE for SYSTEM — ISE is interactive-only, never legitimately invoked by a service. Easy win.
  5 minFree

• Roll out the conservative ACL ruleset to all non-DC servers. Stage by tier — lab → pre-prod → production with 24h observation between waves.
• Add the aggressive tier (cscript, wscript, msbuild, csc, cmstp, msdt) after telemetry shows they're not in use locally. Never aggressive-tier a build host or a developer workstation.
• Wire the script into your configuration management (Ansible / Puppet / Intune Custom OMA-URI) so new hosts inherit the policy on join.
• Rollback drill: on a production-shaped host, take a deliberately broken state (delete the SDDL backup mid-run) and prove you can still recover via icacls /reset + restore from a known-good baseline image.

Conservative LOLBIN tier denied for SYSTEM on every supported host. Backups stored centrally and version-controlled. Configuration management owns drift. Per-host rollback <5 min. This is the floor — WDAC (Loop 3) is the durable answer.

• Enable command-line auditing via GPO — two settings are required, the admin-template one alone does nothing:
  1. Computer Config → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Detailed Tracking → Audit Process Creation = Success — turns on Event ID 4688 generation.
  2. Computer Config → Admin Templates → System → Audit Process Creation → Include command line in process creation events — appends the full argv to the events. Without (1), this does nothing because no 4688 events are produced.
  15 minFree
• Enable PowerShell Script Block Logging + Module Logging + Transcription. Three separate GPO toggles. Without all three, base64-encoded LOLBIN-style PowerShell is invisible.
  30 minFree
• Deploy Sysmon with SwiftOnSecurity config — Event IDs 1 (process create), 11 (file create), 22 (DNS) cover most LOLBIN behavior.
  2 hoursFree / OSS
• Enable Defender Attack Surface Reduction (ASR) rules in audit mode — specifically the rules for credential theft, Office child processes, and obfuscated scripts. Audit-only first; lots of false positives initially.
  1 hourFree (Defender)
• Write a SIEM saved search that bubbles up the top-10 LOLBINs by daily volume, broken out by parent process. Run it weekly. Spikes = either a new legit workflow (allow-list it) or an incident (investigate it).
  1 hourFree

• Build a "LOLBIN baseline" dashboard: per-host invocation frequency, parent-child process trees, command-line entropy distribution. Anomalies become alertable.
• Author Sigma rules for the high-signal LOLBIN patterns: certutil -decode, mshta http*, regsvr32 /s /u /n /i:http*, bitsadmin /transfer, wmic process call create. Map to MITRE ATT&CK T1218 / T1105 / T1059.
• Process ancestry alerts: any LOLBIN invoked with winword.exe, excel.exe, outlook.exe, or browser as a grandparent. These have no legitimate use case.
• Deploy Velociraptor hunts for retrospective LOLBIN-on-disk scanning — checks every endpoint for binaries copied out of System32 (an attacker dropping a renamed certutil to %TEMP%).

Every Windows host emits command-line + script-block telemetry to central SIEM. LOLBIN dashboard reviewed weekly. Sigma rules for top-20 abuse patterns deployed. Process-ancestry alerts catch Office macro → LOLBIN chains in <5 min. Allow-list informed by 30 days of telemetry, not guesswork.

• Run Build-WDACStarter.ps1 in build-only mode. The script merges DefaultWindows_Audit.xml (ships with Windows, allows Microsoft-signed code) with the LOLBIN deny ruleset and forces Audit Mode.
  15 minFree (built into Windows)
• Deploy the compiled policy to one test host with -Deploy -MultiPolicy. Audit mode is the default. Nothing gets blocked. Everything that would be blocked is logged to Microsoft-Windows-CodeIntegrity/Operational as Event ID 3076.
  30 minFree
• Add Microsoft's Recommended Block Rules — ~150 historically-abused binaries and vulnerable drivers. Microsoft maintains the list; you subscribe.
  30 minFree

• The iteration loop (this is the actual work):
  1. Deploy audit-mode policy to a pilot of 10–25 representative hosts.
  2. Run a full week with normal workload. Holiday weeks don't count.
  3. Review Event ID 3076 hits. For each legitimate hit:
     • Allow by publisher (broadest, e.g. specific vendor signing cert).
     • Allow by hash (narrowest, safest).
     • Allow by path — only if admin-write-protected.
  4. Write a supplemental allow-policy XML. Deploy. Re-audit.
  5. When 3076 hits show only the LOLBINs you want blocked, flip the policy to enforce by removing Enabled:Audit Mode.
  6. Roll forward in waves: pilot → department → region → fleet.
• DLL signing enforcement: once EXE policy is stable, enable DLL enforcement. Catches reflective DLL loading. Bigger audit-mode window required (4–6 weeks) because the noise floor is higher.
• Script enforcement: turn on Enabled:Script Enforcement as the final phase. Affects PowerShell modules and MSI installers — biggest blast radius, save for last.
• Allow-policy hygiene: version your supplemental XMLs in git. Code review every change. Document why each allow exists. Unowned allows accumulate and erode the policy.

Every supported Windows host runs WDAC in enforce mode. Microsoft-signed code allowed by default. Microsoft Block List enforced. Conservative + aggressive LOLBIN tiers denied. Renaming or relocating a binary does not bypass policy. Allow-list versioned in git, owned by a named team.

• Subscribe to the LOLBAS project RSS / GitHub releases — canonical inventory, updates monthly.
  5 minFree
• Watch the Microsoft Block Rules markdown commits — GitHub watch / Atom feed surfaces changes.
  5 minFree
• Schedule a quarterly review of the WDAC supplemental allow-policies. Anything not referenced in the last 90 days = candidate for removal.
  1 hour/quarterFree

• Monthly cadence: review LOLBAS additions, pre-existing-host-state telemetry, and event 3076/3077 hit rates. Decide what to add to deny / allow lists.
• Quarterly cadence: pull the latest Microsoft Block List, diff against deployed policy, merge additions, redeploy in audit mode for 1 week, then enforce.
• Patch coupling: any Patch Tuesday that ships new System32 binaries triggers a 7-day audit-mode re-validation on a canary host before fleet rollout.
• Allow-list drift report: dashboard showing supplemental allows added per quarter, who owns each, last hit date. Force-rationalize quarterly.

Policy update SLA: new MS Block List additions deployed within 30 days of publication. New LOLBAS entries triaged within 14 days. Allow-list reviewed quarterly, drift <5%. Cumulative-update binaries validated on canary before fleet rollout.

• Read the WDAC deployment guide — understand the signed-policy lifecycle (you can't un-sign without a signed revocation).
  1 hourFree
• Inventory hosts by management tier: Intune-managed, SCCM-managed, GPO-only, unmanaged. Each gets a different rollout path.
  2 hoursFree

• Signing infrastructure: code-signing cert from internal CA or commercial issuer. Lock the private key in HSM (YubiKey / Azure Key Vault HSM / Thales). Two-person signing for production policy.
• Signed policy deployment: sign the base policy, deploy in audit mode signed, validate, then sign the enforce-mode version. Document the revocation procedure — you will need it.
• Fleet management: Intune Endpoint Security → Application Control or SCCM-distributed .cip files. GitOps-style: policy XML lives in git, CI compiles + signs, deployment pipeline pushes.
• Recovery plan: what if a signed enforce-mode policy bricks the fleet? Documented procedure for boot-into-recovery + signed revocation policy. Test it twice before production rollout.
• Compliance mapping: NIST 800-53 SI-7, CIS Controls 2.5 / 2.6, ISO 27001 A.12.5, NIS2 Article 21(2)(e) — application control is named in all of them. Map your policy to the controls you need to evidence.

Signed WDAC policy enforced on every supported host, managed centrally via Intune/SCCM. Two-person signing for production changes. Tested recovery procedure for catastrophic policy failure. Compliance evidence auto-exported quarterly. A locally-compromised admin cannot disable application control.

Coverage Matrix — ACL Deny vs WDAC Enforce

Defense in Depth: Free Afternoon Deploy

Program Economics (200-seat reference)

Downloads