Skip to content

Allow custom SID for writable directories #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dp001 wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Allow custom SID for writable directories #6

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0629be7
CustomUserOrGroupSid
dp001 Apr 16, 2019
6ac83e0
$CustomUserOrGroupSid if
dp001 Apr 16, 2019
afe6f73
customUserOrGroupSid
Apr 16, 2019
70b79da
Ignored Files
Apr 16, 2019
cf3761a
Use hashtable output in GetSafePathsToAllow.ps1 supporting "Label" an…
rmoreas Apr 8, 2019
be56d6a
Merge pull request #1 from rmoreas/master
dp001 Apr 16, 2019
e175388
custom file types
Apr 17, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions AaronLocker/Support/BuildRulesForFilesInWritableDirectories.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,13 +157,23 @@ foreach($fsp in $FileSystemPaths)
# Get-AppLockerFileInformation -Directory inspects files with these extensions:
# .com, .exe, .dll, .ocx, .msi, .msp, .mst, .bat, .cmd, .js, .ps1, .vbs, .appx
# But this script drops .msi, .msp, .mst, and .appx
[array]$scanFileTypes = @('*.bat','*.com','*.exe','*.dll','*.ocx','*.js','*.ps1','*.pyd','*.vbs','*.xll')
Copy link
Copy Markdown

@AaronMargosis AaronMargosis Apr 29, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wish we could specify arbitrary file extensions, but the PowerShell cmdlets don't support them. The problem is that when you pass the Get-AppLockerFileInformation results to New-AppLockerPolicy, it relies on file extension to determine file type based on its own hardcoded list. If you try to manipulate the path name in the file information object to give it a standard extension before passing it to New-AppLockerPolicy, it will still fail because it goes to look for that file and doesn't find it. I considered and quickly discarded an idea to create hard links to the new names and then deleting them after building. For now I'm just running Scan-Directories.ps1 and pulling data out of there for HashRuleData.ps1, or just insisting on good publisher/productname data.


if ($RecurseDirectories)
{
$arrALFI += Get-AppLockerFileInformation -FileType Exe,Dll,Script -Directory $fsp -Recurse
$files += Get-ChildItem * -Path $fsp -File -Force -Recurse -Include $scanFileTypes
for ($i = 0; $i -lt $files.Count; $i++)
{
$arrALFI += Get-AppLockerFileInformation -Path $files[$i].FullName
}
}
else
{
$arrALFI += Get-AppLockerFileInformation -FileType Exe,Dll,Script -Directory $fsp
$files += Get-ChildItem * -Path $fsp -File -Force -Include $scanFileTypes
for ($i = 0; $i -lt $files.Count; $i++)
{
$arrALFI += Get-AppLockerFileInformation -Path $files[$i].FullName
}
}
}
elseif ($fspInfo -is [System.IO.FileInfo])
Expand Down