Windows Applications
Andrei Miroshnikov · 2018
Windows applications can be portable, which do not require installation, or installable, which need to be installed and registered in the local Windows application registry. Depending on how software installation is designed, it may register an application in the Windows software manager database. Windows Installer application installations are easier to monitor than custom-built installers, because they leave more logs in the Windows event log. When executed, all Windows applications, both console and Graphical User Interface (GUI) applications, create a new executable process. When an application encounters an error and cannot function properly, it hangs or crashes. A vulnerability or bug, when exploited, can lead to potential malicious code execution after application crash. This chapter provides information about how to use AppLocker's auditing capabilities for application execution monitoring. It shows an example of the DACL modification dialog in the Process Explorer.