Glossary
Application allow-listing
Permitting only approved executables and scripts to run, blocking everything else by default.
Application allow-listing (application control) enforces a policy of which executables, scripts and libraries may run on a system; anything not explicitly permitted is blocked. On Windows this is implemented with Windows Defender Application Control (WDAC) or AppLocker; on Linux, confinement with SELinux or AppArmor achieves similar goals for services.
On web servers, allow-listing can prevent worker processes such as w3wp.exe or PHP-FPM from launching command interpreters — turning a common web shell behaviour into a blocked, high-fidelity alert.