Block Executables from AppData folder

The SMB Kitchen team from Third Tier has made available (for free) a CryptoLocker Prevention Kit that includes a 20 page document that includes step by step instructions on how to lock down your servers and workstation using Group Policy settings to minimize future attacks.

The purpose of this post is to summarize those steps down to a single page. These steps are specific to SBS 2008/2011, but should be applicable to Windows 2008/2012 servers.

GOAL: create Software Restriction Policies within Group Policies to block executables (.exe) from running when they are located in the AppData folder or subfolders therein.

CREATE POLICIES FOR XP

1. Open up Group Policy and drill down to Domain –> Computers –> SBSComputers
2. Right click on SBSComputers and select ‘Create a GPO in this domain and link…’
3. Title this policy Prevent CryptoLocker XP and click OK
4. Right click on this policy and select Edit
5. Navigate to Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Software Restriction Policies
6. Right click on Software Restriction Policies and click on ‘New Software Restriction Policies’
7. Right click on Additional Rules and click on ‘New Path rule’ and then enter the following information and then click OK
   Path = %AppData%\*.exe
   Security Level = Disallowed
   Description: Don’t allow executables from AppData
8. Repeat Step 7 for AppData subfolders
   Path = %AppData%\*\*.exe
   Security Level = Disallowed
   Description: Don’t allow executables from AppData subfolders
9. Close this policy configuration window
10. From the Prevent CryptoLocker XP policy locate WMI filtering near the bottom of the middle frame and select ‘Windows SBS Client – Windows XP’

CREATE POLICIES FOR VISTA / WIN7 / WIN8

1. Open up Group Policy and drill down to Domain –> Computers –> SBSComputers
2. Right click on SBSComputers and select ‘Create a GPO in this domain and link…’
3. Title this policy Prevent CryptoLocker Vista and higher and click OK
4. Right click on this policy and select Edit
5. Navigate to Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Software Restriction Policies
6. Right click on Software Restriction Policies and click on ‘New Software Restriction Policies’
7. Right click on Additional Rules and click on ‘New Path rule’ and then enter the following information and then click OK
   Path = %localAppData%\*.exe
   Security Level = Disallowed
   Description: Don’t allow executables from AppData
8. Repeat Step 7 for AppData subfolders
   Path = %localAppData%\*\*.exe
   Security Level = Disallowed
   Description: Don’t allow executables from AppData subfolders
9. Close this policy configuration window
10. From the Prevent CryptoLocker Vista and higher policy locate WMI filtering near the bottom of the middle frame and select ‘Windows SBS Client – Windows Vista’