AppLocker

And one that us as attackers find very difficult to operate against.

Yeah, because in my experience with things like AppLocker on endpoints, which I think is now WDAC, which I haven't had as much experience testing against.

But with AppLocker, you can enumerate the policies from the endpoint.

ThreatLocker takes that away.

So AppLocker, you still have a little bit of leniency in what you can do.

You can enumerate policies and potentially have whitelist directories where you can execute payloads or scripts from.

But ThreatLocker kind of closed the book on that.

Can you do stuff with Group Policy? Yes.

Can you do stuff with some of the built-in Windows AppLocker stuff? Yeah, but it's cumbersome.

AppLocker actually is easier.

And just like you did with the Sentinel-1, they have a Cyber Heroes program that they can look at stuff in the background if you're using all their products 24-7.

You can have them do a lot of the approvals for you.

Let's say that most organizations run Windows.

Let's say you're going to stick to Windows, right? There are a few controls in Windows such as AppLocker that if you do enable them, make the life of an intruder much, much, much more difficult.

Right? That's all there is, right? If you have Windows Enterprise Edition, which comes now with Microsoft E3 license.

So let's say that you decided to purchase the bare minimum you have to run a Windows company, which is, you know, these days, basically, it'd be like Microsoft Office E3 license, which comes with something, right? And also comes with Windows Enterprise.