UltimateAppLockerByPassList

UltimateAppLockerByPassList copied to clipboard

Added some SysWOW64 writable paths, verified on Windows Server 2019 20H2

socketz

Fixed name

socketz

Fixed some grammatical errors😉

Himanshu9430

fix some quote and paren issues

1

clr2of8

RUNDLL32.EXE

5

heads up for me blocking %SYSTEM32%\RUNDLL32.EXE by publisher caused pinned items to stop working on win10 1809. thanks for all your work on these rules.

amandaw33

https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Wmic.exe.md#wmicexe https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html > Blog has been removed > Sorry, the blog at subt0x11.blogspot.com has been removed. This address is not available for new blogs. > Did you expect to see...

evandrix

AppLocker policies here seem to be a bit outdated. Consider updating it according to https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules Currently https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb (Workflows compiler) bypasses that ruleset.

fsacer

some case did not list

2

some case from https://pentestlab.blog did not list https://pentestlab.blog/2017/06/12/applocker-bypass-file-extensions/ https://pentestlab.blog/2017/06/06/applocker-bypass-assembly-load/ https://pentestlab.blog/2017/05/22/applocker-bypass-weak-path-rules/ https://pentestlab.blog/2017/07/07/applocker-bypass-createrestrictedtoken/ does it mean they work against the non-default rules ?

wmliang

- dnx.exe --> sadly it should go for the path blocking rules - fsianycpu.exe: it's a component for Visual Studio Professional Publisher: O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US Product: FSIANYCPU BinaryName:...

AkosBakos

Just an Update for the documentation. This technique is no vallid applocker bypass ;-) https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/DLL-Execution.md#urldll---fileprotocolhandler

HanseSecure