{"id":349,"title":"Windows GPO Tabanl\u0131 Uygulama Engelleme: Kullan\u0131c\u0131 Ba\u011flam\u0131nda G\u00fcvenlik Sertle\u015ftirmesi","content":"

Bu yap\u0131land\u0131rma, Kullan\u0131c\u0131 Ba\u011flam\u0131nda Uygulama Engelleme<\/strong> stratejisi ile LOLBins ve bilinen kötü amaçl\u0131 yaz\u0131l\u0131mlar\u0131n çal\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyerek sald\u0131r\u0131 yüzeyini minimize eder.<\/p>\n

Temel GPO Yap\u0131land\u0131rmas\u0131<\/h2>\n

1. Yeni GPO Olu\u015fturma<\/h3>\n
# PowerShell ile GPO olu\u015fturma\nNew-GPO -Name \"W11-User-Application-Blocking\" -Comment \"LOLBins ve malware engellemesi\"\n\n# OU'ya ba\u011flama\nNew-GPLink -Name \"W11-User-Application-Blocking\" `\n           -Target \"OU=Users,DC=contoso,DC=local\" `\n           -LinkEnabled Yes `\n           -Order 1\n<\/code><\/pre>\n
2. Loopback Processing Yap\u0131land\u0131rmas\u0131<\/h3>\n
Computer Configuration → Policies → Administrative Templates → System → Group Policy\n→ \"Configure user Group Policy loopback processing mode\" = Enabled (Merge mode)\n<\/code><\/pre>\n
 Security Filtering Yap\u0131land\u0131rmas\u0131<\/h2>\n
PowerShell ile Güvenlik Filtreleme<\/h3>\n
# GPO Security Filtering ayarlama\n$GPO = Get-GPO -Name \"W11-User-Application-Blocking\"\n\n# Varsay\u0131lan \"Authenticated Users\" kald\u0131r\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"Authenticated Users\" `\n                  -TargetType Group `\n                  -PermissionLevel None\n\n# Standart kullan\u0131c\u0131lar\u0131 ekle\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"Domain Users\" `\n                  -TargetType Group `\n                  -PermissionLevel GpoApply\n\n# Local Users ekle (SID kullanarak)\nSet-GPPermission -Name $GPO.DisplayName `\n                  -TargetName \"S-1-5-32-545\" `\n                  -TargetType Group `\n                  -PermissionLevel GpoApply\n\n# Hariç tutulacak gruplar (Read only izni)\n$ExcludedGroups = @(\n    \"Domain Admins\",\n    \"Enterprise Admins\",\n    \"IT-Helpdesk\",\n    \"Security-Admins\"\n)\n\nforeach ($group in $ExcludedGroups) {\n    Set-GPPermission -Name $GPO.DisplayName `\n                      -TargetName $group `\n                      -TargetType Group `\n                      -PermissionLevel GpoRead\n}\n<\/code><\/pre>\n
Engellenecek Uygulamalar Listesi<\/h2>\n
Kategorize Edilmi\u015f Engelleme Listesi<\/h3>\n
# Tam engelleme listesi\n$BlockedApplications = @{\n    # Script Motorlar\u0131 ve Shell'ler\n    \"ScriptEngines\" = @(\n        \"powershell.exe\",\n        \"pwsh.exe\",\n        \"powershell_ise.exe\",\n        \"wscript.exe\",\n        \"cscript.exe\",\n        \"mshta.exe\",\n        \"cmd.exe\",\n        \"bash.exe\",\n        \"wsl.exe\"\n    )\n    \n    # \u0130ndirme\/C2 LOLBins\n    \"DownloadC2\" = @(\n        \"bitsadmin.exe\",\n        \"certutil.exe\",\n        \"curl.exe\",\n        \"ftp.exe\",\n        \"tftp.exe\",\n        \"xwizard.exe\"\n    )\n    \n    # Kurulum\/Proxy-Execution\n    \"ProxyExecution\" = @(\n        \"msiexec.exe\",\n        \"installutil.exe\",\n        \"regsvr32.exe\",\n        \"rundll32.exe\"\n    )\n    \n    # Persistence\/Lateral Movement\n    \"PersistenceLateral\" = @(\n        \"schtasks.exe\",\n        \"wmic.exe\",\n        \"winrs.exe\",\n        \"cmdkey.exe\",\n        \"reg.exe\"\n    )\n    \n    # Bilinen Malware\/Araçlar\n    \"KnownMalware\" = @(\n        \"agenttesla.exe\",\n        \"darkcomet.exe\",\n        \"havoc.exe\",\n        \"masscan.exe\",\n        \"meterpreter.exe\",\n        \"mimikatz.exe\",\n        \"mimilib.dll\",\n        \"msfvenom.exe\",\n        \"mythic.exe\",\n        \"nanocore.exe\",\n        \"ncat.exe\",\n        \"netcat.exe\",\n        \"nmap.exe\",\n        \"nping.exe\",\n        \"pathping.exe\",\n        \"pcalua.exe\",\n        \"pubprn.vbs\",\n        \"remcos.exe\",\n        \"revenge_rat.exe\",\n        \"sekurlsa.exe\",\n        \"sliver.exe\",\n        \"teamserver.exe\",\n        \"token.exe\",\n        \"vbc.exe\",\n        \"wevtutil.exe\",\n        \"winexe.exe\",\n        \"wusa.exe\",\n        \"xwizard.exe\",\n        \"wlrmdr.exe\",\n        \"zmap.exe\"\n    )\n}\n<\/code><\/pre>\n
GPO Registry Ayarlar\u0131<\/h2>\n
Registry.pol Dosyas\u0131 Olu\u015fturma<\/h3>\n
function Create-AppBlockingRegistry {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    $regPath = \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\"\n    \n    # Komut sat\u0131r\u0131 eri\u015fimini engelle\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"DisableCMD\" `\n        -Type DWORD `\n        -Value 2\n    \n    # Registry editörlerini engelle\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"DisableRegistryTools\" `\n        -Type DWORD `\n        -Value 1\n    \n    # Run menüsünü devre d\u0131\u015f\u0131 b\u0131rak\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $regPath `\n        -ValueName \"NoRun\" `\n        -Type DWORD `\n        -Value 1\n}\n<\/code><\/pre>\n
Software Restriction Policies (SRP) Yap\u0131land\u0131rmas\u0131<\/h2>\n
PowerShell ile SRP Olu\u015fturma<\/h3>\n
function Configure-SoftwareRestrictionPolicies {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    # SRP için temel path\n    $srpPath = \"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers\"\n    \n    # Varsay\u0131lan güvenlik seviyesi (Unrestricted)\n    Set-GPRegistryValue -Name $GPOName `\n        -Key $srpPath `\n        -ValueName \"DefaultLevel\" `\n        -Type DWORD `\n        -Value 262144\n    \n    # Her bir engellenecek uygulama için hash rule olu\u015ftur\n    $ruleGuid = 0\n    foreach ($category in $BlockedApplications.Keys) {\n        foreach ($app in $BlockedApplications[$category]) {\n            $ruleGuid++\n            $guidString = \"{\" + [guid]::NewGuid().ToString().ToUpper() + \"}\"\n            \n            # Path rule olu\u015ftur\n            $rulePath = \"$srpPath\\0\\Paths\\$guidString\"\n            \n            Set-GPRegistryValue -Name $GPOName `\n                -Key $rulePath `\n                -ValueName \"ItemData\" `\n                -Type String `\n                -Value \"*\\$app\"\n            \n            Set-GPRegistryValue -Name $GPOName `\n                -Key $rulePath `\n                -ValueName \"SaferFlags\" `\n                -Type DWORD `\n                -Value 0\n        }\n    }\n}\n<\/code><\/pre>\n
ADMX Template Olu\u015fturma<\/h2>\n
Custom ADMX Template<\/h3>\n
<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<policyDefinitions xmlns:xsd=\"http:\/\/www.w3.org\/2001\/XMLSchema\"\n                   xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\n                   revision=\"1.0\"\n                   schemaVersion=\"1.0\"\n                   xmlns=\"http:\/\/schemas.microsoft.com\/GroupPolicy\/2006\/07\/PolicyDefinitions\">\n  \n  <policyNamespaces>\n    <target prefix=\"w11block\" namespace=\"Microsoft.Policies.W11ApplicationBlocking\" \/>\n  <\/policyNamespaces>\n  \n  <resources minRequiredRevision=\"1.0\" \/>\n  \n  <categories>\n    <category name=\"W11_App_Blocking\" displayName=\"$(string.W11_App_Blocking)\">\n      <parentCategory ref=\"windows:System\" \/>\n    <\/category>\n  <\/categories>\n  \n  <policies>\n    <policy name=\"BlockLOLBins\" \n            class=\"User\" \n            displayName=\"$(string.BlockLOLBins)\"\n            explainText=\"$(string.BlockLOLBins_Help)\"\n            key=\"Software\\Policies\\W11Block\"\n            valueName=\"BlockLOLBins\">\n      <parentCategory ref=\"W11_App_Blocking\" \/>\n      <supportedOn ref=\"windows:SUPPORTED_Windows_10_0\" \/>\n      <enabledValue>\n        <decimal value=\"1\" \/>\n      <\/enabledValue>\n      <disabledValue>\n        <decimal value=\"0\" \/>\n      <\/disabledValue>\n    <\/policy>\n  <\/policies>\n<\/policyDefinitions>\n<\/code><\/pre>\n
Test ve Do\u011frulama<\/h2>\n
Test Script'i<\/h3>\n
function Test-ApplicationBlocking {\n    [CmdletBinding()]\n    param(\n        [string]$TestUser = \"testuser@domain.local\"\n    )\n    \n    # Test edilecek uygulamalar\n    $testApps = @(\n        @{Name=\"PowerShell\"; Path=\"powershell.exe\"; Command=\"-NoProfile -Command Write-Host 'Test'\"},\n        @{Name=\"CMD\"; Path=\"cmd.exe\"; Command=\"\/c echo Test\"},\n        @{Name=\"CertUtil\"; Path=\"certutil.exe\"; Command=\"-?\"}\n    )\n    \n    Write-Host \"Testing Application Blocking for: $TestUser\" -ForegroundColor Cyan\n    Write-Host \"=\" * 50\n    \n    foreach ($app in $testApps) {\n        try {\n            # RunAs ile test\n            $credential = Get-Credential -UserName $TestUser\n            $process = Start-Process -FilePath $app.Path `\n                                    -ArgumentList $app.Command `\n                                    -Credential $credential `\n                                    -PassThru `\n                                    -Wait `\n                                    -ErrorAction Stop\n            \n            if ($process.ExitCode -eq 0) {\n                Write-Host \"\u274c $($app.Name): NOT BLOCKED\" -ForegroundColor Red\n            } else {\n                Write-Host \"\u2705 $($app.Name): BLOCKED\" -ForegroundColor Green\n            }\n        }\n        catch {\n            Write-Host \"\u2705 $($app.Name): BLOCKED (Exception)\" -ForegroundColor Green\n        }\n    }\n}\n<\/code><\/pre>\n
Rollback Plan\u0131<\/h2>\n
Acil Durum Geri Alma<\/h3>\n
function Emergency-Rollback {\n    param(\n        [string]$GPOName = \"W11-User-Application-Blocking\"\n    )\n    \n    # GPO'yu devre d\u0131\u015f\u0131 b\u0131rak\n    $GPO = Get-GPO -Name $GPOName\n    $GPO.GpoStatus = \"AllSettingsDisabled\"\n    \n    # GPO linklerini kald\u0131r\n    Get-GPOReport -Name $GPOName -ReportType Xml | \n        Select-Xml -XPath \"\/\/LinksTo\/SOMPath\" | \n        ForEach-Object {\n            Remove-GPLink -Name $GPOName -Target $_.Node.InnerText -Confirm:$false\n        }\n    \n    # Kullan\u0131c\u0131larda zorla güncelleme\n    Invoke-Command -ComputerName (Get-ADComputer -Filter *).Name -ScriptBlock {\n        gpupdate \/force\n    }\n    \n    Write-Host \"Emergency rollback completed!\" -ForegroundColor Yellow\n}\n<\/code><\/pre>\n
Monitoring ve Raporlama<\/h2>\n
Event Log \u0130zleme<\/h3>\n
# AppLocker\/SRP event monitoring\nfunction Get-BlockedApplicationEvents {\n    param(\n        [int]$Hours = 24\n    )\n    \n    $startTime = (Get-Date).AddHours(-$Hours)\n    \n    # Event ID'ler\n    # 865: SRP blocked\n    # 866: SRP warning\n    # 8003: AppLocker blocked\n    \n    Get-WinEvent -FilterHashtable @{\n        LogName = 'Application'\n        ID = 865, 866, 8003\n        StartTime = $startTime\n    } | Select-Object TimeCreated, Id, Message, UserId |\n        Export-Csv \"BlockedApps_$(Get-Date -Format 'yyyyMMdd').csv\"\n}\n<\/code><\/pre>\n
Önemli Uyar\u0131lar<\/h2>\n
Kritik Dikkat Edilmesi Gerekenler<\/h3>\n
    \n
  1. \n
    rundll32.exe Engelleme<\/strong><\/p>\n
      \n
    • Birçok sistem fonksiyonu rundll32 kullan\u0131r<\/li>\n
    • Engellemeden önce kapsaml\u0131 test yap\u0131n<\/li>\n
    • Alternatif: Yaln\u0131zca belirli DLL'lere izin verin<\/li>\n<\/ul>\n<\/li>\n
    • \n
      msiexec.exe K\u0131s\u0131tlamas\u0131<\/strong><\/p>\n
        \n
      • Windows Update'ler etkilenebilir<\/li>\n
      • SCCM\/Intune da\u011f\u0131t\u0131mlar\u0131 bozulabilir<\/li>\n
      • Çözüm: Sistem hesaplar\u0131 için istisna<\/li>\n<\/ul>\n<\/li>\n
      • \n
        wevtutil.exe<\/strong><\/p>\n
          \n
        • Log toplama sistemleri etkilenebilir<\/li>\n
        • SIEM entegrasyonlar\u0131 kontrol edilmeli<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
          \u0130leri Seviye Yap\u0131land\u0131rmalar<\/h2>\n
          AppLocker ile Entegrasyon<\/h3>\n
          <AppLockerPolicy Version=\"1\">\n  <RuleCollection Type=\"Exe\" EnforcementMode=\"Enabled\">\n    <FilePublisherRule Id=\"a61c8b3c-a27f-4c8b-8e8a-8b4e62d8565f\" \n                       Name=\"MICROSOFT WINDOWS OPERATING SYSTEM\" \n                       Description=\"\" \n                       UserOrGroupSid=\"S-1-1-0\" \n                       Action=\"Allow\">\n      <Conditions>\n        <FilePublisherCondition PublisherName=\"O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\" \n                                ProductName=\"MICROSOFT® WINDOWS® OPERATING SYSTEM\" \n                                BinaryName=\"*\">\n          <BinaryVersionRange LowSection=\"*\" HighSection=\"*\"\/>\n        <\/FilePublisherCondition>\n      <\/Conditions>\n      <Exceptions>\n        <!-- LOLBins exception listesi -->\n        <FilePathCondition Path=\"%SYSTEM32%\\certutil.exe\"\/>\n        <FilePathCondition Path=\"%SYSTEM32%\\bitsadmin.exe\"\/>\n      <\/Exceptions>\n    <\/FilePublisherRule>\n  <\/RuleCollection>\n<\/AppLockerPolicy>\n<\/code><\/pre>\n
          Sonuç ve Öneriler<\/h2>\n
          Bu GPO tabanl\u0131 uygulama engelleme stratejisi:<\/p>\n
            \n
          • \u2705 Kullan\u0131c\u0131 seviyesinde güçlü kontrol sa\u011flar<\/li>\n
          • \u2705 LOLBins sald\u0131r\u0131 vektörlerini minimize eder<\/li>\n
          • \u2705 MITRE ATT&CK T1218 tekniklerini engeller<\/li>\n
          • \u2705 Zero Trust prensipleriyle uyumludur<\/li>\n<\/ul>\n
            Kritik Ba\u015far\u0131 Faktörleri:<\/strong><\/p>\n
              \n
            1. Test ortam\u0131nda kapsaml\u0131 validasyon<\/li>\n
            2. Kademeli da\u011f\u0131t\u0131m stratejisi<\/li>\n
            3. \u0130stisna yönetimi prosedürleri<\/li>\n
            4. Sürekli monitoring ve iyile\u015ftirme<\/li>\n<\/ol>\n
              v<\/p>","excerpt":"Bu yap\u0131land\u0131rma,\u00a0Kullan\u0131c\u0131 Ba\u011flam\u0131nda Uygulama Engelleme stratejisi ile LOLBins ve bilinen k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 engelleyerek sald\u0131r\u0131 y\u00fczeyini minimize eder.","created_at":"2025-11-26 17:47:33","updated_at":"2026-09-08 00:39:21","category_id":6,"view_count":747,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-26 14:47:33","featured_image":"resimyok.jpg","slug":"windows-gpo-tabanli-uygulama-engelleme-kullanici-baglaminda-guvenlik-sertlestirmesi","category_name":"Sistem","category_slug":"sistem"}