Package: applocker
AppLockerTheapplockermodule allows you to easily parse and create AppLocker Policy XML files and/or strings in Python.InstallationTo install theapplockermodule via pip, run the command:$pipinstallapplockerUsageStart by importing theapplockermodule.>>>importapplockerThe functionapplocker.load, loads an AppLocker Policy XML file.>>>withopen('example.xml','r')asfile:...applocker.load(file)The functionapplocker.loads, loads an AppLocker Policy XML string.>>>applocker.loads('<AppLockerPolicy Version="1" />')In addition to loading an existing AppLocker Policy, policies created using the relevant Conditions, Rules and Rule Collections can be dumped to an XML file using theapplocker.dumpfunction.>>>withopen('example.xml','w')asfile:...applocker.dump(policy,file)Or, an XML string using theapplocker.dumpsfunction.>>>applocker.dumps(policy)FilePublisherRuleTo create a file publisher AppLocker rule to allow or deny digitally signed files, aapplocker.conditions.FilePublisherConditionmust be created optionally specifying aapplocker.conditions.BinaryVersionRange.This condition can then be used to create aapplocker.rules.FilePublisherRule.>>>fromapplocker.conditionsimportBinaryVersionRange,FilePublisherCondition>>>fromapplocker.rulesimportFilePublisherRule>>>binary_version_range=BinaryVersionRange(low_section='10.0.19041.1',high_section='10.0.19041.1')>>>condition=FilePublisherCondition(...publisher_name='O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US',...product_name='MICROSOFT® WINDOWS® OPERATING SYSTEM',...binary_name='CMD.EXE',...binary_version_range=binary_version_range...)>>>rule=FilePublisherRule(...id='00000000-0000-0000-0000-000000000000',...name='Deny everyone execution of cmd.exe',...description='',...user_or_group_sid='S-1-1-0',...action='Deny',...conditions=[...condition...]...)FilePathRuleTo create a file path AppLocker rule to allow or deny files based upon their path, aapplocker.conditions.FilePathConditioncondition must be created.This condition can then be used to create aapplocker.rules.FilePathRule.>>>fromapplocker.conditionsimportFilePathCondition>>>fromapplocker.rulesimportFilePathRule>>>condition=FilePathCondition(path='C:\Windows\System32\cmd.exe')>>>rule=FilePathRule(...id='00000000-0000-0000-0000-000000000000',...name='Deny everyone execution of cmd.exe',...description='',...user_or_group_sid='S-1-1-0',...action='Deny',...conditions=[...condition...]...)FileHashRuleTo create a file hash AppLocker rule to allow or deny files based upon their hash, one or moreapplocker.conditions.FileHashobjects and aapplocker.conditions.FileHashConditioncondition must be created.This condition can then be used to create aapplocker.rules.FileHashRule.>>>fromapplocker.conditionsimportFileHash,FileHashCondition>>>fromapplocker.rulesimportFileHashRule>>>hash=FileHash(...type='SHA256',...data='0x9BB897814C6E1A2A2701D2ADB59AAC2BCACB9CF265DDF3F61B9056EA6FFE04C7',...source_file_name='cmd.exe',...source_file_length='289792'...)>>>condition=FileHashCondition(file_hashes=[hash])>>>rule=FileHashRule(...id='00000000-0000-0000-0000-000000000000',...name='Deny everyone execution of cmd.exe',...description='',...user_or_group_sid='S-1-1-0',...action='Deny',...conditions=[...condition...]...)RuleCollectionTo create a rule collection one or more rules must be created as described above.These rules can then be used to create aapplocker.rules.RuleCollection.>>>fromapplocker.rulesimportRuleCollection>>>rule_collection=RuleCollection(...type='Exe',...enforcement_mode='Enforcing',...rules=[...rule...]...)AppLockerPolicyTo create an AppLocker Policy one or more rule collections must be created as described above.These rule collections can then be used to create anapplocker.policy.AppLockerPolicy.>>>fromapplocker.policyimportAppLockerPolicy>>>policy=AppLockerPolicy(...version='1',...rule_collections=[...rule_collection...]...)