{
	"id": "1db66647-69e8-41ac-9c3d-468d9b517e5a",
	"created_at": "2026-04-06T00:09:19.975568Z",
	"updated_at": "2026-04-10T03:20:42.241304Z",
	"deleted_at": null,
	"sha1_hash": "117497732d6ac608e3ce99f8a10a36da41631508",
	"title": "DLL rules in AppLocker",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 32174,
	"plain_text": "DLL rules in AppLocker\r\nBy jsuther1974\r\nArchived: 2026-04-05 14:12:22 UTC\r\nThis article describes the file formats and available default rules for the DLL rule collection.\r\nAppLocker defines DLL rules to include only the following file formats:\r\n.dll\r\n.ocx\r\nImportant\r\nIf you use DLL rules, a DLL allow rule has to be created for each DLL that is used by all of the allowed apps,\r\nincluding Windows system files.\r\nThe following table lists the default rules that are available for the DLL rule collection.\r\nPurpose Name User\r\nRule condition\r\ntype\r\nAllows members of the local\r\nAdministrators group to run\r\nall DLLs\r\n(Default Rule) All\r\nDLLs\r\nBUILTIN\\Administrators Path: *\r\nAllow all users to run DLLs\r\nin the Windows folder\r\n(Default Rule)\r\nMicrosoft Windows\r\nDLLs\r\nEveryone Path: %windir%*\r\nAllow all users to run DLLs\r\nin the Program Files folder\r\n(Default Rule) All\r\nDLLs located in the\r\nProgram Files folder\r\nEveryone\r\nPath:\r\n%programfiles%*\r\nCaution\r\nWhen DLL rules are used, AppLocker must check each DLL that an app loads. Therefore, users may experience a\r\nreduction in performance if DLL rules are used on computers that are resource constrained.\r\nRelated articles\r\nUnderstanding AppLocker default rules\r\nhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker\r\nPage 1 of 2\n\nSource: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rul\r\nes-in-applocker\r\nhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker"
	],
	"report_names": [
		"dll-rules-in-applocker"
	],
	"threat_actors": [],
	"ts_created_at": 1775434159,
	"ts_updated_at": 1775791242,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/117497732d6ac608e3ce99f8a10a36da41631508.pdf",
		"text": "https://archive.orkl.eu/117497732d6ac608e3ce99f8a10a36da41631508.txt",
		"img": "https://archive.orkl.eu/117497732d6ac608e3ce99f8a10a36da41631508.jpg"
	}
}