Application Allowlisting (Whitelisting).

Application allowlisting (formerly whitelisting) flips the default-allow model of antivirus: only executables, DLLs, scripts, and installers that match an approved policy — by hash, publisher signature, or path — are permitted to run, and everything else is blocked. Microsoft AppLocker and Windows Defender Application Control (WDAC), Linux fapolicyd, macOS notarization gates, and standalone products like Airlock Digital and ThreatLocker implement the pattern. NIST SP 800-167 (Guide to Application Whitelisting) documents the architecture, and the Australian Signals Directorate's Essential Eight lists application control as one of its top mitigations against targeted intrusions.

The hard part is not blocking obvious malware but closing bypasses. Attackers abuse living-off-the-land binaries (LOLBins) — signed, Microsoft-trusted tools like mshta.exe, regsvr32.exe, msbuild.exe, and installutil.exe — to execute code that a naive allowlist trusts because the loader is signed. Microsoft therefore publishes a recommended block rules list for WDAC to neutralise these known bypasses, and mature policies enforce DLL and script rules, not just executable rules, so an allowed process cannot side-load an unsigned library or run an arbitrary script. Path-based rules are the weakest form (a user-writable allowed directory defeats them); publisher and hash rules are stronger but demand real change management, because every patch changes hashes and every new tool needs an approval workflow.

flowchart TD
  A[Process / DLL / script<br/>requests execution] --> B{Matches allow policy?}
  B -->|Hash match| C[Allow]
  B -->|Trusted publisher signature| C
  B -->|Approved path| C
  B -->|No match| D[Block + log]
  C --> E{Is it a known<br/>LOLBin bypass?}
  E -->|Yes, in block rules| D
  E -->|No| F[Run]
  D --> G[Alert / approval workflow]

Well-run in audit-then-enforce mode, allowlisting is highly effective against fileless attacks, unsigned ransomware, and untrusted downloads — but only when DLL/script enforcement and the recommended block rules are turned on, otherwise LOLBins quietly walk through the front door.