Application Control, Ringfencing, Network and Storage Control for K-12: ThreatLocker and AppLocker Playbook (2026)

Jim’s 10 Quick Hits

The first ten, in order. Every deny goes through Monitor first; every GPO goes through its audit event first. Then the rest of the phased rollout in order.

1. Confirm every group’s Default policy is Deny and the group is Secured

Do this	Open each computer group (DCs, Tier 0 Hypervisors, Tier 1 Infrastructure, OT, Workstations, PAWs). Confirm the Default policy is Deny, not Monitor, and the group mode is Secured. Screenshot each.
Why	An empty “Last Match” on an existing deny can mean the group was still in Learning or Monitor. Nothing else in this guide matters until this is true.
Where	ThreatLocker portal › Computer Groups › each group › Default policy and mode
Effort	30 minutes

2. Add the tier-0 deny block to the top of the DC policy list, Monitor Only

Do this	Create the C1 denies (`ntdsutil`, `dsdbutil`, `esentutl`, `vssadmin` / `diskshadow` / `wbadmin`, `ldifde` / `csvde` / `dsquery`, `wmic`, `dnscmd`, WinRM hosts, `mshta` / `certutil` / `bcdedit`, download proxies, .NET compilers, `mmc`) as Add to top, policy status Monitor Only. The low-risk set (`msdt`, `powershell_ise` / `pwsh`, `taskmgr`, `cmstp`, `at`, `finger`, `tftp`) can go straight to Secured; see Phase 2.
Why	Windows Core Files sits at order 999,995 and permits every signed Microsoft binary. A deny below it never matches. Monitor first so the backup agent and RMM reveal themselves before anything is enforced.
Where	Policies › DC group › New policy › Add to top
Effort	Half a day; two to four weeks of monitoring

3. Fix any “Ringfenced” policy with empty ringfence tabs; remove browsers and Office from DCs and servers

Do this	A policy whose name says Ringfenced but whose Applications, Internet, Files and Registry tabs are empty is a plain permit; WMI, Office, Office Installer and RunDLL are the usual ones. Configure the tabs (C3) or remove the application from the DC and server groups. Uninstall browsers, Office, OneDrive, Google Updater, Windows Phone and Communication App from DCs and servers; delete their policies; any Office or browser match on a DC in Unified Audit is an incident to explain, not noise.
Why	A policy named “Ringfenced” with nothing in the ringfence tabs is a plain permit. Nothing on a DC needs a browser.
Where	Policies › filter by name; Applications on each DC
Effort	Half a day

4. Deny wsmprovhost, winrshost and winrs everywhere; disable WinRM by GPO where unused

Do this	Deny the WinRM host and client binaries on DCs, Tier 1, OT and workstations. Ringfenced permit on Hyper-V hosts only if Windows Admin Center or PowerShell remoting is used there. GPO: WinRM service Disabled on workstations and on any server nobody manages remotely.
Why	PowerShell remoting rides WinRM. An agent signed in as an admin can run commands on every server that answers.
Where	Policies (deny, Secured after the monitor period); Computer Configuration › Policies › Windows Settings › Security Settings › System Services › Windows Remote Management
Effort	One day; the monitor period finds the one host that needs it

5. Network Control: workstation to DC on AD-client ports only; workstation to workstation deny; management from the jump host only

Do this	Workstation › DC: allow 53, 88, 123/udp (time), 389/636 plus 389/udp (CLDAP locator), 445, 464, 3268/3269, 135 + RPC dynamic; deny 5985/5986, 3389, 139. Workstation › workstation: deny inbound 445, 135, 3389, 5985, 5900. Jump host or PAW › DCs and servers: allow 3389, 5985/5986 (where kept), 135/445 from the jump host object only. Monitor two weeks, enforce one.
Why	A credential is only as dangerous as what it can reach. 445 to DCs stays open; SYSVOL and NETLOGON need it or Group Policy stops applying.
Where	ThreatLocker › Network Control policies per group; free: Windows Firewall GPO inbound rules on the DC and workstation OUs scoped to source subnets
Effort	Two weeks monitor, one enforce

6. Server VLANs outbound default-deny with per-role allowlists; alert on LLM hostnames

Do this	Server and management VLANs: outbound denied except WSUS/Windows Update, Defender, NTP, KMS, CA CRL, ThreatLocker, RMM, backup cloud and named vendor FQDNs. DNS query logging from server VLANs to the SIEM; alert on any LLM-provider hostname.
Why	A domain controller has no business reaching the internet. An agent on a compromised server phones home to a legitimate AI API that every filter allows.
Where	Perimeter firewall per VLAN; ThreatLocker Network Control outbound; Windows Firewall outbound default block on the server OU
Effort	Two weeks monitor, one enforce

7. Explicit denies for every RMM you don’t use, plus outbound denies to their relays

Do this	Permit one RMM by certificate and path. Explicit deny for AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer, NetSupport, Level, RustDesk, Syncro, Action1, Supremo, LogMeIn, GoTo, Zoho, VNC, Ammyy and DWAgent. Deny `quickassist.exe` and `msra.exe` for non-IT. Outbound denies to the other vendors’ relays and ports (5938, 6568/7070, 8040/8041, 5900-5910, 7000).
Why	A second RMM is the most common persistence tool in ransomware incidents, and it is signed, so default-deny alone is not enough once a permit for “Microsoft Corporation” or a broad certificate exists.
Where	Policies › deny by publisher; Network Control outbound; free: AppLocker publisher deny per vendor plus Windows Firewall outbound block
Effort	Half a day

8. DCSync rights audit and 4662 alert; dnscmd deny and DnsAdmins audit; Locksmith against the CA

Do this	Only DCs, Administrators and one sync account hold Replicating Directory Changes All; delete stale MSOL_, ADSync and Exchange ACEs; alert on 4662 with GUID `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` from a non-DC. Deny `dnscmd.exe` (temporary permit on the DNS server); treat DnsAdmins as Domain Admins on any DNS server missing the October 2021 update, and audit membership everywhere. Run Locksmith monthly.
Why	Each is a one-step path from a foothold to every password in the domain.
Where	ADSI Edit › domain root › Security; ThreatLocker policies; `Invoke-Locksmith -Mode 1`
Effort	Half a day

9. Hyper-V hosts into Tier 0: PAW-only access, vTPM on DC VMs, export and checkpoint alerting, Storage Control on VHDX paths

Do this	Hyper-V Administrators = Domain Admins only; management from the PAW; BitLocker on CSVs; vTPM on DC, backup and sync VMs; Storage Control deny on `.vhdx` `.vhd` `*.vmdk` outside the VM paths; alert on the Hyper-V-VMMS Admin log events for a DC export or checkpoint (confirm the IDs on a test export before you trust the rule).
Why	Whoever can export a DC’s disk has every password without touching the DC.
Where	Hyper-V Manager; ThreatLocker Storage Control; a SIEM rule on the VMMS log
Effort	One day

10. Honeytokens and the five never-legitimate rules with active response

Do this	A decoy SPN account, a `creds.csv` with a SACL in the script share, a canary document and API key, a decoy computer object. Active response (disable account, isolate host, page) on: DCSync from a non-DC; Kerberoast of the decoy SPN; any match on a Secured tripwire deny on a DC; a computer moved out of Secured mode or a Tier 0 policy edited; a privileged-group add outside a change window.
Why	An agent enumerates everything at machine speed. Each decoy fires on exactly that, and an alert with no action at 2 AM is an audit log.
Where	ThreatLocker Detect; SIEM active response; canarytokens.org
Effort	One afternoon

How to read this guide

TAG	MEANING
TL	ThreatLocker: application control, ringfencing, Network Control, Storage Control, Elevation Control, Detect.
AL	AppLocker: launch allow and deny rules by publisher, path or hash. Built into every supported Windows edition, Pro included since the October 2022 updates; enforcement needs the Application Identity service.
WDAC	Windows Defender Application Control / App Control for Business: kernel-enforced, stronger than AppLocker, harder to author.
ASR	Defender Attack Surface Reduction rules: the behavioral half AppLocker lacks.
FW	Windows Firewall, pushed by GPO.
GPO	Group Policy, nothing else needed.

★ marks the items to fix first.

Tiers used throughout. Tier 0 = domain controllers, hypervisors, the backup server, sync servers, AD CS, PAWs. Tier 1 = member servers. Tier 2 = workstations. OT = HVAC, cameras, access control.

The AppLocker ceiling. AppLocker or WDAC (launch denies) + ASR (behaviors) + Windows Firewall GPO (ports) + Defender for Endpoint if licensed (command-line detections) covers about 70% of this playbook. The missing 30% is ringfencing and per-process network control. Where a row says “no AL equivalent,” that is the 30%.

Phased rollout

PHASE	SCOPE	DURATION	EXIT CRITERIA
0 — Audit	Unified Audit (or AppLocker 8003 events) for 30–60 days: filter by the backup agent, RMM and vendor process paths, and by every binary in the controls catalog. Identify who holds DCSync rights, DnsAdmins, Hyper-V Administrators, Protected Users. Run Locksmith and PingCastle.	2 weeks of reading	Written list of legitimate matches per binary
1 — Groups and defaults	Build computer groups (Mechanics). Confirm Default = Deny and Secured per group. Remove browsers, Office, OneDrive and Google Updater from DC and server groups. Fix any “Ringfenced” policy with empty ringfence tabs. Move existing denies above any permit that could shadow them.	1 week	Every group’s Default policy verified by screenshot
2 — Low-risk denies, enforced	`msdt`, `powershell_ise`, `pwsh`, Task Manager, `cmstp`, `at`, `finger`, `tftp`, tunnelers, every RMM you don’t use, interpreters on servers. Secured Mode.	Same week	No matches during Phase 0
3 — Tripwires, Monitor Only	`ntdsutil`, `dsdbutil`, `esentutl`, `vssadmin` / `diskshadow` / `wbadmin`, `ldifde` / `csvde` / `dsquery`, `wmic`, `dnscmd`, `reg.exe`, `netsh`, LSASS dumpers, PowerShell bypasses, rundll32 DLL blocklist, `wmiprvse` / `dllhost` no-child ringfences.	2–4 weeks (4–6 on workstations)	Backup jobs succeed with guest processing; RMM and monitoring still work
4 — Tripwires, enforced	Flip Phase 3 to Secured (or Inherit for backup-adjacent). Carve permits by parent process or certificate for backup and RMM.	1 week	24 h clean on DCs, then servers, then workstations
5 — Network Control	Inbound per role from the jump host; workstation › DC on AD-client ports only; workstation › workstation deny; server VLAN outbound default-deny; DNS egress lockdown. Monitor first.	2 weeks monitor + 1 enforce	WSUS, KMS, NTP, CRL and vendor FQDNs allowlisted; GPO still applies; the backup server still reaches hosts
6 — Identity and protocol GPOs	One at a time, each with its audit event enabled first: NTLM audit (8004) › `LmCompatibilityLevel 5`; LDAP 2889 audit › signing + channel binding required; SMB signing; Protected Users one admin per day; deny-logon GPOs on the correct OUs; krbtgt rotation; DSRM.	1 control per week	Zero audit hits for 2 weeks before each enforce
7 — Detect, deception, response	Alert rules, honeytokens, active response on the never-legitimate rules, IR runbook, restore rehearsal.	Ongoing	Each rule has an owner and a documented response

Mechanics: ThreatLocker behavior that decides whether a policy works

MECHANIC	RULE
Evaluation order	Lowest order number first; first match wins. Windows Core Files sits at 999,995 and permits every signed Microsoft binary. A deny below it never matches.
Add to top vs bottom	Denies › Add to top. Ringfence permits › add to top. Temporary permits › top (above the matching deny), with an expiry.
Policy status	Inherit Status From Computer = follows the computer’s mode. Secured Mode = enforced regardless of computer mode. Monitor Only Mode = logs regardless.
Which status for what	Tripwire denies (`ntdsutil`, WinRM hosts, `mshta`, `certutil`, `dnscmd`, LSASS dumpers) › Secured after the monitor period, so Learning mode on a box cannot reope them. Backup-adjacent denies (`vssadmin`, `wbadmin`, `esentutl`, `reg.exe`) › Inherit. Everything new › Monitor Only first.
Kill Running Processes	On for deny policies. Off for ringfence permits.
Show Notification / Allow Request	Off on servers and DCs. On for workstations (the request workflow is the user experience).
Selected Users & Groups	One deny for everyone, a permit scoped to the IT group above it. Shrink the IT group’s workstation footprint to a PAW over time.
Custom applications `tttracer` …) › Applications › New Application › Path + Certificate (Microsoft Windows publisher), both `System32` and `SysWOW64` paths. Never hash-only; updates brea	Binaries not in the built-in catalog (`wsmprovhost`, `ntdsutil`, `esentutl`, `diskshadow`, `ldifde`, `csvde`, `dsquery`, `cmstp`, `at`, `finger`, `tftp`, `dsdbutil`, hash rules.
Ringfence tabs	APPLICATIONS (what it can launch or interact with; empty exception list = no child processes), INTERNET, FILES, REGISTRY. Each has its own Monitor Only toggl
Parent process restrictions	Agent 10.6.2+. Use to permit a binary only under a backup agent or RMM parent instead of permitting it broadly.
DLL and script control	Confirm DLL tracking is on for the DC and server groups; confirm script control is on so unknown `.ps1`, `.vbs` and `.bat` are denied even where the interpreter is permitted.
Computer groups	DCs · Tier 0 Hypervisors · Tier 1 Infrastructure · OT · Workstations · PAWs. Policies are per group; confirm each group’s Default policy is Deny and the group is Secured.
Unified Audit	The ground truth. Filter by group, action, date, process path. Use it before every enforce decision and first in every incident.

Mechanics: AppLocker behavior and limits

MECHANIC	RULE
Rule collections	Executable, Windows Installer, Script, Packaged app, DLL (off by default; turning it on is noisy but required to stop sideloading).
Rule types	Publisher (preferred; survives updates), Path (bypassable via user-writable paths), Hash (brittle).
Enforcement	Requires the Application Identity service running; an admin can stop it. Set the service to Automatic via GPO and alert on it stopping (Event 7036).
Audit mode	Enforcement = Audit only per collection. Event log `AppLocker/EXE and DLL`: 8003 = would have blocked, 8004 = blocked; `AppLocker/MSI and Script`: 8006 / 8007; `AppLocker/Packaged app-Execution`: 8022 / 8025.
Default rules	Create default rules first (allow `C:\Windows\` and `C:\Program Files\` for Everyone, allow all for Administrators), then layer deny rules above. Deny always wins over allow in AppLocker.
Known gaps	Path rules allow user-writable folders under `C:\Windows` (`Tasks`, `Temp`, `tracing`, `System32\spool\drivers\color`, others): add explicit deny path rules. LOLBins that execute code without a new EXE (`msbuild`, `installutil`, `regasm`, `mshta`, `rundll32`, `regsvr32`) need their own deny rules. No ringfencing, no network control, no storage control.
WDAC instead	For servers and DCs, WDAC / App Control for Business with the Microsoft Recommended Block Rules XML is stronger: kernel-enforced, covers most LOLBAS binaries and the vulnerable-driver blocklist. Harder to author; deploy via Intune or `ConvertFrom-CIPolicy` + GPO; run in audit first.
ASR rules	Defender Attack Surface Reduction gives the behavioral half AppLocker lacks: Office child processes, LSASS credential theft, PsExec/WMI process creation, script-launched downloaded content, USB unsigned executables. Enable in audit, then block.
Minimum free stack	AppLocker or WDAC (launch denies) + ASR (behaviors) + Windows Firewall GPO (ports) + Defender for Endpoint if licensed (command-line detections). Covers about 70% of this playbook; the missing 30% is ringfencing and per-process network control.

AppLocker quick deny set (PowerShell). Build publisher deny rules for the tier-0 LOLBin set from reference files on a DC:

$bins = 'ntdsutil','esentutl','vssadmin','diskshadow','wbadmin','ldifde','csvde','dsquery',
        'wmic','dnscmd','mshta','certutil','bcdedit','msdt','bitsadmin','cmstp','wsmprovhost','winrshost','winrs'
$files = $bins | % { Get-ChildItem "C:\Windows\System32\$_.exe","C:\Windows\SysWOW64\$_.exe" -ErrorAction SilentlyContinue }
$info  = $files | Get-AppLockerFileInformation
$pol   = New-AppLockerPolicy -FileInformation $info -RuleType Publisher -User Everyone -RuleNamePrefix 'Deny-LOLBin'
# No -Optimize: every file shares one publisher and product, so -Optimize collapses them into a
# single BinaryName="*" rule, which as a Deny would block every Windows binary.
# Edit the XML: set Action="Deny" (New-AppLockerPolicy creates Allow rules), confirm each rule keeps its
# BinaryName, and set BinaryVersionRange LowSection="*" so older file versions are denied too. Then:
# Set-AppLockerPolicy -XmlPolicy .\deny-lolbins.xml -Merge -Ldap "LDAP://CN={GPO-GUID},CN=Policies,CN=System,DC=domain,DC=local"

C1 · Tier-0 LOLBin denies

Apply to DCs, servers and workstations unless the row says otherwise.

BINARY	WHAT IT DOES FOR AN ATTACKER	THREATLOCKER	APPLOCKER / FREE
`ntdsutil.exe`	Dumps NTDS.dit + SYSTEM via IFM	Deny, Secured; pre-built temporary permit for recovery	AL publisher deny; WDAC block rule
`dsdbutil.exe`	AD LDS twin of ntdsutil	Deny, Secured	AL deny
`esentutl.exe`	Copies locked files (NTDS.dit, SAM)	Deny, Monitor › Secured	AL deny
`vssadmin.exe` `diskshadow.exe` `wbadmin.exe`	Shadow-copy NTDS.dit; delete recovery points	Deny, Monitor › Inherit; permit the backup agent by parent or certificate	AL deny for Everyone, allow for the backup service account
`ldifde.exe` `csvde.exe` `dsquery.exe` `dsget.exe dsacls.exe` `adfind.exe`	Bulk AD export and recon	Deny; temporary permit for schema work	AL deny
`wmic.exe`	Remote process creation, AV enumeration, XSL bypass	Deny (Monitor first for old RMM)	AL deny; ASR “Block process creations from PsExec and WMI”
`dnscmd.exe`	`serverlevelplugindll` = SYSTEM code execution on DNS for any DnsAdmins member on servers missing the October 2021 fix (CVE-2021-40469); still the tool for remote zone and forwarder changes	Deny; temporary permit on the DNS server	AL deny
`wsmprovhost.exe` `winrshost.exe` `winrs.exe` `winrm.cmd` WinRM / PSRemoting host and client `winrm.vbs`		Deny on DCs, Tier 1, OT, workstations; ringfenced permit on Hyper-V hosts only if WAC or PowerShell is used	AL deny; GPO disable the WinRM service
`mshta.exe` `certutil.exe` `bcdedit.exe` `signtool.exe`	HTA execution, download and decode, boot tamper	Deny; keep it in the top deny block, above every permit	AL deny; WDAC block rules
`msdt.exe`	Follina	Deny (change from ringfence)	AL deny
`powershell_ise.exe` `pwsh.exe`	Alternate PowerShell hosts	Deny	AL deny
`taskmgr.exe`	One-click LSASS dump	Deny; permit the IT group on workstations	AL deny for non-admins; ASR LSASS rule
`bitsadmin.exe` `cmstp.exe` `ftp.exe` `tftp.exe finger.exe` `at.exe`	Download and execution proxies	Deny	AL deny
`msbuild.exe` `installutil.exe` `regasm.exe regsvcs.exe` `csc.exe` `vbc.exe` `aspnet_compiler.exe ilasm.exe` `jsc.exe` `microsoft.workflow.compiler.exe wfc.exe` `dotnet.exe`	.NET compile and execute allowlist bypass	Deny (`dotnet.exe` deny on servers; workstations only if no app needs it)	AL deny; WDAC block rules
`mmc.exe`	UAC bypass, snap-in access	Deny on DCs, OT, Hyper-V; ringfence on Tier 1; deny for users on workstations	AL deny for non-admins
`regsvr32.exe` ★	Squiblydoo: `/i:http://… scrobj.dll` runs a scriptlet; it works offline too, so blocking the DLL alone is not enough.	Deny for users; permit by parent (`msiexec`, your installers)	AL deny; WDAC block rule
`wevtutil.exe` `auditpol.exe` ★	Log clearing and audit disable, the first step of the standard pre-encryption script	Deny, Secured on DCs; never legitimate from a non-admin host	AL deny
`manage-bde.exe` `repair-bde.exe` ★	BitLocker as ransomware, used repeatedly in 2024– 25. The `.wsf` is in the scripts row; the EXE needs its own deny	Deny; permit the IT group where BitLocker is managed	AL deny
`diskpart.exe` `format.com` `reagentc.exe` `vshadow.exe`	Wipe, format, disable WinRE; `vshadow` is a Microsoft-signed SDK shadow-copy tool that bypasses the `vssadmin` deny	Deny	AL deny
`icacls.exe` `takeown.exe` `cacls.exe` `attrib.exe taskkill.exe`	Permission and attribute tampering and process killing ahead of encryption	Ringfence no-child; deny for users on workstations; Monitor first (logon scripts)	AL deny for users

C2 · LOLBAS additions

GROUP	BINARIES	THREATLOCKER	APPLOCKER
LSASS / NTDS `tttracer.exe` `ttdinject.exe` `rdrleakdiag.exe` `createdump.exe` dump	`sqldumper.exe` `dump64.exe` `adplus.exe` `cdb.exe` `ntsd.exe procdump.exe`	Deny, Secured	AL deny; ASR LSASS
PowerShell bypasses	`runscripthelper.exe` `syncappvpublishingserver.exe syncappvpublishingserver.vbs` `sqlps.exe` `sqltoolsps.exe` `wt.exe openconsole.exe`	Deny (permit `wt.exe` for IT on workstations)	AL deny
Forced auth / sniffing / screen capture	`rpcping.exe` `pktmon.exe` `nmcap.exe` `psr.exe` (Steps Recorder: silent screenshots, not sniffing)	Deny	AL deny
Remote exec / transfer	`ssh.exe` `scp.exe` `sftp.exe` `bash.exe` `wsl.exe` `wbemtest.exe devtunnel.exe`	Deny (permit `ssh` for IT)	AL deny
Execution proxies	`atbroker` `change` `query` `reset` `customshellhost` `runexehelper provlaunch` `setres` `stordiag` `sigverif` `unregmp2` `wlrmdr workfolders` `write` `setupugc` `ie4uinit` `iediagcmd` `ieexec infdefaultinstall` `register-cimprovider` `rasautou` `extexport` `wab verclsid` `pcwrun` `presentationhost` `applaunch` `dfsvc` `addinutil appinstaller` `cmdl32` `replace` `diantz` `print` `hh` `forfiles pcalua` `scriptrunner` `odbcconf` `mavinject` `msxsl` `xwizard` `certoc desktopimgdownldr` `winget`	Deny (`dfsvc` and `applaunch` break ClickOnce; `customshellhost` breaks kiosk mode; check)	AL deny
Staging / compression	`makecab` `expand` `extrac32` `tar` `compact`	Deny on servers; ringfence on workstations	AL deny
UAC bypass (workstations)	`computerdefaults` `eudcedit` `iscsicpl` `wsreset` `odbcad32`	Deny	AL deny
Tamper	`fltmc.exe` `cipher.exe` `pnputil.exe`	Deny (`pnputil` permit IT)	AL deny
Print	`printbrm.exe` `pubprn.vbs`	Deny except print-server IT during migrations	AL deny
Scripts	`cl_loadassembly.ps1` `cl_mutexverifiers.ps1` `cl_invocation.ps1 utilityfunctions.ps1` `pester.bat` `launch-vsdevshell.ps1` `manage-bde.wsf` (ringfence if BitLocker)	Deny by hash (script control on)	AL Script collection deny
Only if installed	VS, SQL and debugger tools (`csi` `rcsi` `tracker` `vstest.console dbgsrv` `windbg` `remote` `bginfo` `msdeploy` `te` `coregen acccheckconsole`)	Default deny covers; audit for any bare “Microsoft Corporation” certificate permit	—
UAC bypass (most used)	`fodhelper` `eventvwr` `sdclt` `slui` `dccw` `perfmon`	Ringfence “no child processes” rather than deny	No AL equivalent for no-child; a deny breaks the tools
Accessibility backdoors	`sethc` `utilman` `osk` `narrator` `magnify` `displayswitch`	Ringfence `winlogon.exe` to its normal children (see C3) plus those tools, nothing else; Registry ringfence on `Image File Execution Options`	FIM on IFEO; no AL equivalent
Persistence and `sdbinst.exe` (shim persistence) `runonce.exe` `gpscript.exe` `wuauclt.exe` Deny `sdbinst` and `sdiagnhost`; ringfence no-execution	(`/UpdateDeploymentProvider` DLL load) `conhost.exe --headless sdiagnhost.exe` (diagcab packages run PowerShell even with `msdt` denied)	child on `runonce` `gpscript` `wuauclt conhost`	AL deny; WDAC block rules
Signed downloaders and execution proxies	Downloaders: `ConfigSecurityPolicy.exe` (Defender; `MpCmdRun -DownloadFile` was removed in 2020) `OneDriveStandaloneUpdater.exe GfxDownloadWrapper.exe` (Intel) `Msohtmed.exe` `ProtocolHandler.exe AppVLP.exe` (Office). Execution proxies: `fsi.exe` `mftrace.exe OfflineScannerShell.exe` `vsdiagnostics.exe` `dxcap.exe` (if VS or SDKs exist)	Downloaders: ringfence Internet blocked except the vendor’s update FQDNs; no child processes. Proxies: deny unless the SDK is in use. All are Microsoft- or OEM-signed, so a certificate-based permit passes them	AL deny where unused; no network equivalent
AD recon and lateral movement (workstations)	`setspn.exe` `klist.exe` `repadmin.exe` `dcdiag.exe` `ldp.exe adsiedit.msc` `tasklist` `systeminfo` `tscon.exe` (RDP session hijack as SYSTEM) `mstsc.exe` (non-IT) `telnet.exe` `sshd.exe` `ssh-agent.exe` (OpenSSH Server enabled as a backdoor)	Deny for users on workstations alongside `dsquery`; `tscon` deny everywhere; permit `mstsc` for IT	AL deny for users
Sandboxes and `WindowsSandbox.exe` and `.wsb` files, Docker Desktop, WSL (`wsl.exe` plus control escape	`dism.exe` `dismhost.exe` enabling the features)	Deny; code running inside these is outside the agent	AL deny; GPO Windows features
VS Code tunnels ★	`code.exe tunnel` `code-tunnel.exe`	Deny `code-tunnel.exe`; ringfence `code.exe` Internet to the Marketplace; outbound deny `.tunnels.api.visualstudio.com .devtunnels.ms`	AL deny `code-tunnel.exe`; hostname block on the DNS filter or perimeter firewall (Windows Firewall cannot match hostnames)
AI coding agents on servers	Claude Code, Codex, Gemini CLI, Cursor, Copilot CLI	Deny on Tier 0 and Tier 1: these are shells with outbound network, the LLM-hostname concern in process form	AL deny by publisher
Sysinternals	`livekd` (dumps kernel memory including LSASS) `procexp` and its driver (kills EDR via BYOVD; the driver is Microsoft-signed and not on the vulnerable-driver blocklist, so the deny has to come from policy) `sdelete` `psloggedon` `pskill psservice` `adexplorer` `handle`	Deny for all but the IT PAW. The Store-packaged Sysinternals Suite installs under `WindowsApps`	AL: add a Packaged-app deny; the default Packaged-app rule allows it
Archivers and sync tools	`rclone` `7z.exe` `rar.exe` WinSCP MEGAsync	Unsigned or third-party, so default deny catches them. If 7-Zip is permitted org-wide, ringfence it: no internet, no reads of `Documents` or shares	AL deny
Scripts, addition `slmgr.vbs` (the same scrobj COM hijack as `winrm.vbs`)		Deny by hash	AL Script collection deny

C3 · Ringfences

ThreatLocker only. AppLocker has no equivalent; ASR is noted where it overlaps. Each ringfence tab has its own Monitor Only toggle.

rundll32.exe

Applications	No child processes
Internet	Blocked
Files / registry	Files: deny reads of `comsvcs.dll` `advpack.dll` `ieadvpack.dll` `syssetup.dll` `setupapi.dll` `url.dll` `mshtml.dll` `scrobj.dll zipfldr.dll` `pcwutl.dll` `shdocvw.dll` `ieframe.dll` `desk.cpl` `dfshim.dll` `davclnt.dll` (WebDAV `DavSetCookie`) `keymgr.dll`; leave `shell32.dll`
Notes / free overlap	A RunDLL policy with no ringfence configured is a plain permit; configure all three tabs. ASR LSASS rule covers the `comsvcs` case.

wmiprvse.exe

Applications	No child processes
Internet	Blocked
Files / registry	Off
Notes / free overlap	Monitor: virtualization management, RMM and backup-agent steps use it. ASR “PsExec and WMI” overlaps.

dllhost.exe

Applications	No child processes
Internet	Blocked
Files / registry	Off
Notes / free overlap	—

reg.exe

Applications	No child processes
Internet	Blocked
Files / registry	Deny reads of `HKLM\SAM`, `HKLM\SECURITY`, `HKLM\SYSTEM` (the attack is `reg save`, not `reg export`)
Notes / free overlap	Logon scripts and RMM use it; Monitor first.

net.exe net1.exe nltest.exe

Applications	No child processes
Internet	Blocked
Files / registry	—
Notes / free overlap	`net use` in logon scripts.

sc.exe schtasks.exe

Applications	No child processes
Internet	Blocked
Files / registry	—
Notes / free overlap	Ringfencing `schtasks.exe` does not stop task execution: tasks run under `svchost (Schedule)`. Pair with 4698/4702 alerting.

netsh.exe

Applications	No child processes
Internet	Blocked
Files / registry	—
Notes / free overlap	Permit on the DHCP server and Hyper-V hosts; deny elsewhere.

msiexec.exe

Applications	Child processes limited to known installers
Internet	Blocked
Files / registry	—
Notes / free overlap	Pair with Elevation Control.

mofcomp.exe fsutil.exe regedit.exe regini.exe certreq.exe control.exe msconfig.exe colorcp

Applications	No child processes
Internet	Blocked (`certreq`: CA only)
Files / registry	—
Notes / free overlap	Deny for non-admin users on workstations via Selected Users & Groups.

cmd.exe wscript.exe cscript.exe

Applications	No child processes except the interpreters a script legitimately calls; permit by parent for logon scripts
Internet	Blocked
Files / registry	—
Notes / free overlap	Consider denying Windows Script Host for non-admins.

PowerShell

Applications	Constrained Mode; child processes per script need
Internet	Blocked
Files / registry	—
Notes / free overlap	Remove the PowerShell 2.0 engine. Module, script-block and transcript logging where permitted. Review any Add-Type or Windows Assembly .NET permit; with Constrained Mode it is usually unnecessary.

curl.exe certreq.exe

Applications	No child processes
Internet	Approved domains only, or blocked
Files / registry	—
Notes / free overlap	—

Microsoft Office (workstations)

Applications	No `cmd` `powershell` `wscript` `cscript` `mshta` `regsvr32` `certutil` `rundll32`
Internet	Update and authentication endpoints only
Files / registry	No writes to the Startup folder
Notes / free overlap	ASR “Block Office child processes”, “Block Office from creating executable content”; MOTW macro block GPO.

Browsers

Applications	Own helpers only
Internet	—
Files / registry	No reads of other browsers’ profile directories
Notes / free overlap	Extension allowlist by GPO (ThreatLocker cannot see extensions).

PDF readers, Teams, Zoom, Outlook, msedgewebview2 msedge_proxy squirrel.exe update.exe

Applications	No child processes
Internet	—
Files / registry	—
Notes / free overlap	ASR “Block executable content from email client”.

explorer.exe

Applications	—
Internet	—
Files / registry	Block launches from `%TEMP%`, Downloads, AppData
Notes / free overlap	Storage Control plus ringfence.

spoolsv.exe (print server only)

Applications	`PrintIsolationHost` `splwow64` `printfilterpipelinesvc` and the print vendor only
Internet	Blocked
Files / registry	Deny writes to `spool\drivers` by anything else
Notes / free overlap	Disable the service everywhere else.

wsmprovhost.exe (Hyper-V hosts only)

Applications	No child processes except what Monitor shows (the remote runspace runs inside `wsmprovhost` itself and never spawns `powershell.exe`; children are whatever remote commands call, such as `netsh` or `dism`)
Internet	Blocked
Files / registry	—
Notes / free overlap	Deny elsewhere.

w3wp.exe ★ (IIS, Exchange, SharePoint)

Applications	No child processes: a webshell spawns `cmd` or `powershell` under the worker
Internet	—
Files / registry	—
Notes / free overlap	Server-side code hosts need the no-child ringfence the interpreter row gives `java`. Monitor first for app pools that legitimately spawn helpers.

sqlservr.exe

Applications	No child processes (`xp_cmdshell`)
Internet	Blocked
Files / registry	—
Notes / free overlap	Also disable `xp_cmdshell` and Ole Automation in SQL; the ringfence is the backstop.

services.exe

Applications	Children limited to known service binaries (smbexec-style service › `cmd`)
Internet	Blocked
Files / registry	—
Notes / free overlap	Monitor 2–4 weeks; pair with 7045 alerting on a new service whose ImagePath contains `cmd` or `powershell`.

Backup service binaries

Applications	No child processes except the backup product’s own components
Internet	Vendor FQDNs only
Files / registry	—
Notes / free overlap	A backup server runs as the most privileged account in the domain; its services should never spawn a shell.

winlogon.exe

Applications	Children limited to `userinit` `LogonUI` `dwm` `fontdrvhost` `mpnotify` `wlrmdr` `rdpclip` (RDP sessions) and the accessibility tools `sethc` `utilman` `osk` `narrator` `magnify` `displayswitch`, nothing else; confirm the list against two weeks of Monitor before enforcing
Internet	Blocked
Files / registry	Registry ringfence: deny writes under `Image File Execution Options`
Notes / free overlap	Closes the sticky-keys family of backdoors. Free: FIM on IFEO.

vmwp.exe (Hyper-V)

Applications	—
Internet	Blocked
Files / registry	Never add a Files or Registry ringfence to `vmms` `vmwp` `vmcompute` `clussvc`
Notes / free overlap	—

Vendor suites (HVAC, VMS, print management)

Applications	Own processes only
Internet	Vendor license and update FQDNs only
Files / registry	Deny reads outside install, data and recording paths
Notes / free overlap	Monitor 3–4 weeks; the noisiest ringfences you will build.

Interpreters where required ( java python node)

Applications	No child processes except the vendor’s
Internet	Blocked
Files / registry	Deny `%TEMP%` and Downloads
Notes / free overlap	Permit by path + certificate of the vendor’s bundled runtime, never system-wide.

C4 · Fixes to an inherited policy set

Most ThreatLocker tenants were built over years by more than one admin. These are the patterns to look for before adding anything new.

PATTERN	ACTION
Policies named “Ringfenced” with empty ringfence tabs (WMI, Office, Office Installer, RunDLL are the usual ones)	Configure the tabs, or remove the application from DC and server groups
Each group’s Default policy	Confirm Deny, not Monitor
Time-windowed deny policies (nights-and-weekends style)	Retire; make the deny permanent (Task Manager and the like)
An MMC block policy on DCs	Keep; remove redundant per-snap-in entries such as `dsa.msc`
Denies that sit below a broad permit (`certutil` `signtool` `mshta` `bcdedit` at a higher order number than a Microsoft-signed permit)	Move them into the top deny block
Browsers, Office, OneDrive, Google Updater, Windows Phone, Communication App on DCs and servers	Uninstall; delete the policies; explain any historical match in Unified Audit
`spoolsv.exe` on DCs	Ringfence until print is off the DC, then disable the service + Deny. Print belongs on a member server
Add-Type .NET / Windows Assembly .NET permits	Review any historical match; usually unnecessary with Constrained Mode

C5 · Workstation-specific

Deny remote execution and admin tools for users

ThreatLocker	`winrs` `wsmprovhost` `winrshost` `psexec` `paexec` `wmic` `schtasks` `at` `dsquery` `dsget` `ldifde` `csvde` `adfind` `nltest dsacls`, RSAT, SharpHound / BloodHound / AD Explorer / PingCastle / PowerView, `mmc`
AppLocker / free	AL deny; Everyone deny + IT allow

Recon tools

ThreatLocker	`whoami` `quser` `qwinsta` `nbtstat` `arp` `route` `netstat`: deny or ringfence (Monitor; logon scripts)
AppLocker / free	AL deny for users

Credential CLIs

ThreatLocker	`cmdkey` `vaultcmd` ringfence; Storage Control on browser `Login Data` and `System32\config`
AppLocker / free	ASR LSASS; no AL equivalent for storage

Elevation Control

ThreatLocker	No local admins; installers elevated by policy; alert on the first-ever elevation request
AppLocker / free	LAPS + no local admin; no equivalent for just-in-time elevation

Admin hygiene

ThreatLocker	No admin, especially a Domain Admin, types a password on a workstation; Protected Users + deny interactive logon for DA on the workstation OU
AppLocker / free	GPO

Interpreters

ThreatLocker	`python` `node` `java` `autoit3` `AutoHotkey`: deny unless needed; ringfence where needed
AppLocker / free	AL deny

File associations

ThreatLocker .js .jse .vbs .vbe .wsf .wsh › Notepad; also .hta .msc (GrimResource) .chm .scr .pif .cpl .reg .scf .xll .rdp (rogue-RDP phishing) .library-ms .search-ms .vhd .vhdx .application; .iso / .img mount handler removed or Storage Control deny; disable the search-ms: and ms-appinstaller: protocol handlers (EnableMSAppInstallerProtocol = 0); remove ms-msdt:

AppLocker / free GPO

Browser extensions

ThreatLocker	Allowlist by ID (Chrome / Edge GPO or Google Admin); Chrome Remote Desktop off
AppLocker / free	GPO / Admin console

Storage Control

ThreatLocker	Deny execution from `%TEMP%`, Downloads, `AppData\Local\Temp`, `C:\Users\Public`, unowned `ProgramData`, removable media
AppLocker / free	AL path deny rules (partial)

Rollout

ThreatLocker	Monitor 4–6 weeks; carve permits by parent for logon scripts and RMM
AppLocker / free	AL audit mode

C6 · Servers by role

Role-by-role summary.

ROLE	TIER	KEY PERMITS	KEY DENIES / NOTES	INBOUND	OUTBOUND
DHCP	1	`netsh` ringfenced, `mmc` ringfenced	Nothing third-party; dedicated DNS update credential; DHCP snooping on switches; no Option 252	UDP 67 from clients and relays; 647 failover; 135 + RPC from the jump host	68; 53/88/389/445 to DCs; 647
Print	1	`spoolsv` ringfenced to its helpers + the print-management suite by certificate	`printbrm` IT only; Point-and-Print restrictions; `RestrictDriverInstallationToAdministrators = 1`; `RpcAuthnLevelPrivacyEnabled = 1`; v4 drivers	445, 135 + RPC, 9191/9192 from client VLANs	9100/515/631/161 to the printer VLAN; DCs; vendor license
HVAC / BAS	OT	Vendor suite + bundled JRE by path + certificate, ringfenced	Not domain-joined if possible; vendor RMM denied; vendor access time-boxed via ZTNA or jump host; controllers inbound only from this server	80/443 from the facilities VLAN or jump host; 47808/1911/502 from the controller VLAN	Controller VLAN; vendor FQDNs; SMTP relay; NTP
Hyper-V	0	Core Files; backup transport components by certificate; `wsmprovhost` ringfenced only if WAC or PowerShell is used	No Files ringfence on `vmms` `vmwp` `vmcompute` `clussvc`; `netsh` ringfenced; BitLocker CSVs; vTPM on DC, backup and sync VMs; Storage Control on `*.vhdx` outside VM paths; alert on DC export or checkpoint; Hyper-V Administrators = DA	3389/5985/135 from the PAW; 445/6600/3343 between nodes; the backup server	Nodes, storage (3260/445), DCs, WSUS; no internet
Camera / VMS	OT	Vendor suite + SQL Express by certificate, ringfenced	Cameras inbound only from the VMS, no internet; recording path under Storage Control; footage not in the primary backup	Vendor client ports from the security-staff VLAN; 3389 from the jump host	554/80/443 to the camera VLAN; vendor FQDNs; SMTP; NTP
ESXi (if any)	0	—	ThreatLocker does not run here: lockdown mode, SSH off, vCenter MFA, management VLAN from the PAW only, vCenter export and snapshot alerting	—	—

C7 · Network Control and Windows Firewall GPO

Workstation › DC

Rule	Allow 53, 88, 123/udp (w32time; without it clock skew breaks Kerberos within weeks), 389/636 plus 389/udp (CLDAP, used by the DC locator), 445 (SYSVOL and NETLOGON; required for GPO), 464, 3268/3269, 135 + RPC dynamic (test before cutting). Deny 5985/5986, 3389, 139/NetBIOS
Free equivalent	Windows Firewall inbound rules on the DC OU scoped to source subnets

Jump host / PAW › DCs and servers

Rule	Allow 3389, 5985/5986 (where WinRM is kept), 135/445 admin from the jump host object only
Free equivalent	Firewall rule with remote IP = jump host

Workstation › workstation

Rule	Deny all inbound on 445, 135, 3389, 5985, 5900
Free equivalent	Firewall inbound block on the workstation OU

Workstation › internet

Rule	Deny 445/139/137-138 (NTLM leak), 25, 1433, 3389, 5985, 22 (except IT), 4443/8443/9001; 53/853 only to internal DNS; DoH hostnames denied
Free equivalent	Firewall outbound block rules

Servers › internet

Rule	Default deny. Allow WSUS / Windows Update, Defender, NTP, KMS, CA CRL, ThreatLocker, RMM, backup cloud, named vendor FQDNs. Alert on any LLM-provider hostname
Free equivalent	Perimeter firewall per VLAN; Windows Firewall outbound default block on the server OU

Printer, camera and controller VLANs

Rule	Inbound only from their server; no internet
Free equivalent	Perimeter firewall

Guest and BYOD

Rule	Internet only; no route to server or management subnets; logged deny
Free equivalent	Perimeter firewall

RDP schedule

Rule	Server RDP restricted to business hours; break-glass via the jump host
Free equivalent	Perimeter firewall schedule

WinRM

Rule	Service disabled by GPO on workstations and on servers nobody manages remotely; 5985/5986 open only from the management subnet where kept; HTTPS + JEA where used
Free equivalent	GPO + firewall

QUIC and Encrypted Client Hello ★

Rule	Block UDP 443 (QUIC) at the perimeter and in Network Control, or TLS inspection is bypassed entirely. Disable Encrypted Client Hello in browsers by GPO: SNI filtering is blind to it
Free equivalent	Firewall outbound block UDP 443; Chrome and Edge `EncryptedClientHelloEnabled = 0`

WebClient service ★

Rule	Disable the WebClient service by GPO. The 445 egress deny does nothing against WebDAV over 80/443 (`\\host@80\`, `.library-ms`, `search-ms` NTLM leaks)
Free equivalent	GPO System Services › WebClient = Disabled

DNS resolver side ★

Rule “53 only to internal DNS” does not stop tunneling: the DC resolves recursively for the attacker. Forward the DCs to a filtering resolver that logs, rate-limits and blocks DGA and tunnel patterns. Prohibit Windows 11 native DoH by GPO (separate from the browser setting). Block known DoH resolvers: by IP in Windows Firewall (1.1.1.1, 8.8.8.8, 9.9.9.9 and the published ranges for NextDNS, AdGuard, Mullvad and Control D) and by hostname on the DNS filter (dns.nextdns.io dns.adguard.com dns.mullvad.net dns.controld.com)

Free equivalent DNS Server forwarders; GPO Network › DNS Client › Configure DNS over HTTPS = Prohibit; firewall IP block

IPv6 tunnels, WPAD, STUN, SSDP

Rule	Disable Teredo, 6to4 and ISATAP; block protocol 41 and UDP 3544; prefer IPv4 to defang mitm6. Disable WPAD auto-proxy and block the `wpad` name. STUN (UDP 3478; TLS variant on TCP 5349): most P2P remote tools and WebRTC C2 need it; allow only to Teams and Zoom ranges. Disable SSDP/UPnP
Free equivalent	GPO TCPIP settings and `netsh interface teredo set state disabled`; DNS block on `wpad`; firewall

Workstation egress default-deny with an explicit proxy

Rule	Instead of listing bad ports, make workstation egress default-deny through an explicit proxy. That collapses the port list (plus 1080, 4444, 50050, 6667/6697, 5222, 1883, 9001, 1194, 51820) into one rule
Free equivalent	Firewall outbound default block on the workstation OU; proxy by GPO

Registry and file ringfences on proxy and host pivots

Rule	FIM or Registry ringfence on `PortProxy` (`netsh portproxy` SOCKS pivots), `Internet Settings\ProxyServer` and `AutoConfigURL`, `drivers\etc\hosts`, and Outlook `WebView\Inbox\URL` (Specula home-page C2)
Free equivalent	File-integrity monitoring and registry auditing to the SIEM

C8 · Egress and command-and-control

RMM abuse

Control Permit one RMM by certificate + path; explicit deny every other (AnyDesk, ScreenConnect, Atera, Splashtop, TeamViewer, NetSupport, Level, RustDesk, Syncro, Action1, Supremo, LogMeIn, GoTo, Zoho, VNC, Ammyy, DWAgent); deny quickassist.exe and msra.exe for non-IT; outbound denies to other vendors’ relays and ports (5938, 6568/7070, 8040/8041, 5900-5910, 7000). Also deny the ones leading recent intrusion statistics: SimpleHelp, Kaseya VSA, NinjaOne, Datto RMM (CagService), N-able Take Control (BASupSrvc), Pulseway, ManageEngine / Zoho Assist, BeyondTrust / Bomgar, MeshAgent / Tactical RMM, Remote Utilities (rutserv.exe), UltraViewer, AeroAdmin, Radmin (4899), Iperius, RemotePC, Parsec, NoMachine (4000), DameWare (6129), Getscreen, ISL Online, Chrome Remote Desktop host (remoting_host.exe); ports RustDesk 21115–21119, NetSupport 5405, Splashtop 6783–6785, Kaseya 5721, Remote Utilities 5650

Free equivalent AL publisher deny per vendor; firewall outbound block

Tunnelers

Control Deny cloudflared ngrok tailscale chisel ligolo frp plink socat devtunnel; netsh ringfenced; deny outbound to *.ngrok.io *.ngrok-free.app *.trycloudflare.com *.argotunnel.com *.tailscale.com *.zerotier.com *.localtonet.com. Also: *.ngrok.app *.ngrok.dev connect.ngrok-agent.com *.cfargotunnel.com localhost.run serveo.net pinggy.io *.loclx.io (LocalXpose) zrok.io playit.gg bore.pub pagekite.net *.ts.net (Tailscale Funnel) *.netbird.io, Hamachi, Cloudflare WARP (warp-svc.exe, *.cloudflareclient.com), commercial VPN clients (Proton, Mullvad, Nord), Tor (tor.exe, directory-authority IPs, the Snowflake broker; Brave bundles Tor, set TorDisabled), I2P (7657), Psiphon, v2ray / Xray, gost, rathole, revsocks; Edge Secure Network, Opera VPN and iCloud Private Relay (mask.icloud.com) off via GPO

Free equivalent AL deny (mostly unsigned, so default deny catches them); proxy or firewall hostname block

Cloud-service C2 and exfiltration

Control Deny Discord CDN and webhooks, api.telegram.org, WhatsApp Web, Pastebin, transfer.sh, file.io, anonfiles, gofile, mega.nz, ShareFile / Dropbox / Box / WeTransfer unless used; tenant restrictions for M365 and Google at the proxy; deny workstation 80/443 to raw cloud-compute IP ranges unless allowlisted; NRD and uncategorized blocked. Dead-drop, webhook and storage C2: Slack (hooks.slack.com, files.slack.com), Teams incoming webhooks (*.webhook.office.com), Power Automate (*.logic.azure.com), Zapier and IFTTT hooks, t.me and telegra.ph, Trello, Notion and Airtable APIs, steamcommunity.com/profiles (Vidar’s resolver), api.github.com, gists and raw.githubusercontent.com, GitLab, Imgur, Dropbox and Box API hosts, *.blob.core.windows.net *.s3.amazonaws.com storage.googleapis.com firebaseio.com, Backblaze, Wasabi, *.r2.dev. Free hosting as C2: *.workers.dev *.pages.dev *.vercel.app *.netlify.app *.herokuapp.com *.onrender.com *.fly.dev *.glitch.me *.replit.app *.hf.space *.github.io *.azurewebsites.net *.cloudfunctions.net *.run.app script.google.com. Pastes: paste.ee rentry.co hastebin, privatebin, controlc.com termbin.com 0x0.st catbox.moe pixeldrain, bashupload, temp.sh filebin.net ufile.io

Free equivalent Proxy or SWG only; a classroom web filter covers domain blocklists but not IP, port, process or tenant restrictions

Dynamic DNS ★

Control AsyncRAT, XWorm, Remcos, DcRAT and Quasar almost all use *.duckdns.org, No-IP (*.ddns.net *.hopto.org *.zapto.org *.sytes.net *.myftp.org *.redirectme.net *.servehttp.com), *.dyndns.org *.dynu.net, afraid.org domains (*.mooo.com *.chickenkiller.com), *.cloudns.*. NRD blocking does not catch these; the parent domains are old. Block the Dynamic-DNS category at the proxy and alert on any hit

Free equivalent Proxy or SWG category block; DNS log alert

SMTP and FTP exfiltration ★

Control	Denying 25 alone is not enough: Agent Tesla, Snake Keylogger and most stealers exfiltrate over 587/465/2525 to `smtp.gmail.com`, `smtp.office365.com`, SendGrid, Mailgun and Brevo. Deny 25/465/587/2525 from everything except the mail relay. Same for 21/FTP
Free equivalent	Firewall outbound block with the relay as the only exception

Never-legitimate tripwires

Control Cheap, high-signal, no false positives: OAST and collaborator domains (*.oast.* *.oastify.com *.burpcollaborator.net interact.sh dnslog.cn webhook.site requestbin, pipedream, ntfy.sh); external-IP checks from a non-browser process (api.ipify.org ifconfig.me icanhazip.com ipinfo.io ip-api.com checkip.amazonaws.com); any process other than Office, Teams, OneDrive and browsers reaching graph.microsoft.com login.microsoftonline.com *.sharepoint.com docs.google.com www.googleapis.com. That per-process rule is the only practical defense against OneDrive or Google-Docs C2 in a tenant that must allow those hosts

Free equivalent Proxy and DNS log alerts; no free per-process equivalent

DNS tunneling

Control	53/853 only to internal DNS; DoH endpoints denied; browser DoH off by GPO; public resolvers blocked by IP; DNS query logging with TXT-volume and entropy alerts
Free equivalent	Firewall + GPO + DNS logs to the SIEM

ICMP and protocol

Control	Deny outbound ICMP from workstations except monitoring
Free equivalent	Firewall

Loaders

Control	Interpreters denied or ringfenced; Electron and WebView no child processes; WSH off for users; file associations remapped; ISO mount handler removed; extension allowlist; MOTW macro block; HVCI + vulnerable-driver blocklist; `mavinject` deny + rundll32 DLL blocklist
Free equivalent	ASR + GPO + WDAC driver blocklist

Segmentation

Control	Endpoint inbound default-deny; servers reachable only on service ports; Tier 0 on its own VLAN from PAWs only; IoT, printer and camera VLANs isolated; a micro-segmentation product where budget allows
Free equivalent	Perimeter firewall VLAN ACLs + firewall GPO

Egress architecture

Control	Both ThreatLocker Network Control (per process) and the perimeter firewall (catches what the agent missed); a proxy with TLS inspection, category and reputation, NRD, tenant restrictions
Free equivalent	—

C9 · Identity and protocol

GPO; the same for ThreatLocker and AppLocker environments.

DCSync rights

Implementation	Only DCs, Administrators and one sync account hold Replicating Directory Changes All; delete stale MSOL_, ADSync and Exchange ACEs
Audit first	Event 4662 with GUID `1131f6ad-9c07-11d1-f79f-00c04fc2dcd2` from a non-DC › alert

krbtgt

Implementation	Rotate twice, 24 h apart; after any compromise
Audit first	—

Protected Users

Implementation	Every human admin and `-adm` account, one per day; break-glass excluded; deny-logon GPO on the workstation OU for DA
Audit first	Test one account; watch 4625 and 4771

NTLMv1

Implementation	`LmCompatibilityLevel = 5`, DCs first, then all; no LM hash storage
Audit first	NTLM audit 8004 / 4624 `LmPackageName = NTLM V1` for 2 weeks; copiers are the holdout

LDAP signing and channel binding

Implementation	Required
Audit first	Event 2889 on DCs for 2 weeks; fix the web filter, print-management, VPN and RADIUS binds first

SMB signing

Implementation	Required on all
Audit first	—

AD CS

Implementation	Locksmith monthly; no enrollee-supplied subject with client auth for broad groups; manager approval; lock template ACLs (ESC4 › ESC1); AD CS not on a DC
Audit first	Locksmith report

DnsAdmins

Implementation	Treat as Domain Admins on any DNS server missing the October 2021 update; audit membership everywhere; pair with the `dnscmd` deny
Audit first	—

DSRM

Implementation	Rotate; `DsrmAdminLogonBehavior = 0`
Audit first	—

Logon rights

Implementation	Default Domain Controllers Policy: deny network, batch, service and RDP logon for all non-tier-0, including service and automation accounts; smart card or Windows Hello for Business for DA
Audit first	`gpresult`; scope to the DC OU only

Hypervisor admins

Implementation	Tier 0; PAW only; vTPM + BitLocker on DC VMs; snapshot and export alerting
Audit first	—

Backup and VM export hygiene

Implementation	Never land a DC VMDK, VHDX, IFM or system-state on a general share; Storage Control on `.vmdk` `.vhdx` `.vhd` `.bak` `*.dit` outside the repository; backup server off-domain or Tier 0; immutable repository; backup admins not DA; alert on retention change
Audit first	—

BYOVD

Implementation	HVCI / Memory Integrity + the Microsoft vulnerable-driver blocklist on DCs, servers and workstations; alert on new driver loads
Audit first	WDAC driver blocklist

LDAP enumeration

Implementation	Event 1644 expensive-query logging; alert on one host issuing thousands of queries in minutes
Audit first	—

LLMNR, NBT-NS and mDNS

Implementation	Off by GPO; NetBIOS off via DHCP; `EnableMDNS = 0`
Audit first	—

Spooler on DCs and hypervisors

Implementation	Disabled
Audit first	`Get-Service Spooler`

LAPS

Implementation	Windows LAPS; 30-day + on-use rotation; audit reads
Audit first	—

Password policy

Implementation	Length over rotation; fine-grained policy for admins and service accounts
Audit first	—

LSASS hardening

Implementation	`RunAsPPL` with the UEFI lock; Credential Guard (Enterprise and Education SKUs since Windows 10, Server 2016+; on by default from Windows 11 22H2 Enterprise); `WDigest UseLogonCredential = 0`; Remote Credential Guard or Restricted Admin for RDP; reduced `CachedLogonsCount` on servers. Every LSASS-dumper deny in C2 is a tripwire; these make the dump worthless even when a new tool slips past
Audit first	Credential Guard readiness tool; check LSA protection events 12 and 3065/3066 before enabling the UEFI lock

Automation and agent accounts

Implementation	Dedicated scoped account; denied all logon types to DCs; no portal access; rotate any credential an AI agent was run with
Audit first	—

C11 · ThreatLocker portal and agent protection

Portal

Control

MFA enforced; no shared admin accounts; IP allowlist; alert on any computer moved out of Secured mode and any policy edit in the DC and Tier 0 groups

Agent

Control

Uninstall password set; tamper protection on

AppLocker equivalent

Control

Application Identity service Automatic + alert on stop; GPO permissions audited (who can edit the AppLocker GPO = who can disable it)

C12 · Verification and troubleshooting

SYMPTOM / CHECK	WHERE TO LOOK
Did a policy block something?	Unified Audit › group › Action Deny › date › group by application. AppLocker: Event 8004 (8003 in audit) for EXE and DLL; 8007 (8006) for scripts and MSI
Are DCs actually enforcing?	Group mode = Secured; Default = Deny; an empty “Last Match” on existing denies can mean the group was still in Learning or Monitor
“Users can’t sign in, a password reset fixes it”	Not an application-control symptom. Check 4740 lockouts (caller computer › the retrying ringfenced app); unlock without reset to confirm; 4723 vs 4724 for expired or must-change; 4768/4771 `0xE` / `0x18` for RC4 and AES key issues (Protected Users or the encryption GPO). Bulk unlock: `Search-ADAccount -LockedOut \\| Unlock-ADAccount`
GPO not applying after Network Control	445 to DCs blocked; Event 1058/1030 on clients
Backups “succeed” but no guest processing	backup job warnings; ThreatLocker deny on the backup agent runtime
Which clients would break on LDAP signing	Event 2889
Which devices still use NTLMv1	NTLM/Operational 8004; 4624 LmPackageName
Who can DCSync	`(Get-Acl "AD:\DC=domain,DC=local").Access \\| ? {$_.ObjectType -eq '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'}`
Can a workstation reach `Test-NetConnection dc01 -Port 5985` from a workstation; must fail a DC on admin ports
Does DNS leave another way	From a workstation, `nslookup example.com 8.8.8.8`; must fail
Hyper-V DC export	Hyper-V-VMMS Admin log export and checkpoint events (confirm the IDs on a test export); file-integrity monitoring on the export path

C13 · Detect: alert rules

ThreatLocker Detect plus your SIEM. “Yes” means the event is never legitimate and gets an automated response.

RULE	NEVER LEGITIMATE? › ACTIVE RESPONSE
DCSync (4662) from a non-DC	Yes › disable account, isolate host
Kerberoast (4769) for the decoy SPN	Yes › disable account
Any match on a Secured tripwire deny on a DC (`ntdsutil` `wsmprovhost` `dnscmd` `esentutl` LSASS dumpers)	Yes › isolate host
Computer moved out of Secured mode; DC or Tier 0 policy edited	Yes › page
Privileged-group add (4728/4732/4756) outside a change window; new account (4720)	Yes › page
New external forwarding rule; Vault export outside the records role	Yes › suspend user
Logon type 3 to a DC from a workstation subnet by a non-computer, non-tier-0 account	Review
WinRM operational log on any DC or Tier 1 host	Review
Script-block 4104 outside admin hosts	Review
Network Control denies from a process with no prior network history; one host hitting 3+ C2-related denies in 10 minutes	Review
Process launch from Downloads or Temp; any RMM binary; any interpreter on a server; first-ever elevation request	Review
New driver load on any host; retention change or job deletion in the backup products	Review
Server VLAN DNS query for any LLM-provider hostname	Review
DNS: TXT or NULL volume, labels over 50 characters, high entropy	Review
Weekly directory diff: users, privileged groups, domain and OU ACEs, GPO links, trusts	Review
Scheduled task created or updated (4698/4702) outside admin hosts; the `schtasks` ringfence does not stop execution	Review
Beacon periodicity (RITA / Zeek); JA4 fingerprints; TLS to a raw IP with no SNI; HTTP to a raw IP	Review
Scripting user-agents (`python-requests` `curl` `WindowsPowerShell`); long-lived outbound TCP	Review
NXDOMAIN bursts (DGA); BITS-Client 59/60 events with external URLs	Review
7045 new service with `cmd` or `powershell` in ImagePath; `System.Management.Automation.dll` loaded by a non-PowerShell process (Sysmon 7)	Review
Any hit on a Dynamic-DNS, OAST or external-IP-check domain from a non-browser process	Yes › isolate host
Workspace and Entra logs exported to the SIEM; 18 months or more of retention	—

C14 · Deception

Service account with an SPN nobody uses

Alert on

Any 4769 for it

Canary document and API key (canarytokens.org)

Alert on

Any access

Decoy computer object; honeypot host on the client VLAN answering 445/3389/5985

Alert on

Any connection

Canary DC name in DNS; fake RMM shortcut; fake ngrok.exe permit request

Alert on

Any touch

Gate: every deny has been through Monitor first; every GPO has been through its audit event first; each alert rule has an owner and a documented response.