AppLocker
Overview
AppLocker can be used to create rules that specify which applications are allowed to run, based on a variety of criteria, including the file path, publisher, file hash, and version. AppLocker can also be used to create rules that block specific applications or types of applications from running.
Enumerating AppLocker policies
Bypassing examples
Trusted folder
In AppLocker, a Trusted folder is a designated folder or set of folders that are exempt from application control policies. If the default AppLocker rules are applied, you should be able to execute executables from Read/Write/Executable folders within C:\Program Files\ and C:\Windows.
To locate Writeable and executable folder
Using accesschk.exe:
Verify they are executable:
Unmanaged DLLs
AppLocker default rule set does not protect against loading arbitrary DLLs.
References
Last updated
