How does AppLocker classify files?

Question

For example, when a user double-clicks 'actually-a-malicious-exe.txt' - does AppLocker classify by content actions ("Wait a minute, this is trying to launch a process"), or solely by file extension? I've seen SRP catch such deception, but I haven't
found anything detailing exactly how AppLocker responds to this scenario.
How does AppLocker evaluate child processes for applications that do NOT specify LOAD_IGNORE_CODE_AUTHZ_LEVEL or SANDBOX_INERT?

Answer 1

Hi,
Based on my research, AppLocker classifies files by file extension, as you mentioned, if a user opens a 'actually-a-malicious-exe.txt', the notepad process will be used to open this text file for user to read it, instead of initializing
the exe file.
If applications don’t specify values as LOAD_IGNORE_CODE_AUTHZ_LEVEL or SANDBOX_INERT, then they will be examined against AppLocker rules to determine if it’s allowed to run.
In addition, quoted from the article below: “AppLocker rules either allow or prevent an application from launching. AppLocker does not control the behavior of applications after they are
launched. Applications could contain flags passed to functions that signal AppLocker to circumvent the rules and allow another .exe or .dll to be loaded. In practice, an application that is allowed by AppLocker could use these flags to bypass AppLocker rules
and launch child processes. You must thoroughly examine each application before allowing them to run by using AppLocker rules.”
Security Considerations for AppLocker
http://technet.microsoft.com/en-us/library/ee844118(WS.10).aspx
More information for you:
LoadLibraryEx function
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684179(v=vs.85).aspx
Understanding AppLocker Rule Behavior
http://technet.microsoft.com/en-us/library/ee460942.aspx
Best Regards,
Amy Wang