AppLocker

Overview

AppLocker can be used to create rules that specify which applications are allowed to run, based on a variety of criteria, including the file path, publisher, file hash, and version. AppLocker can also be used to create rules that block specific applications or types of applications from running.

Enumerating AppLocker policies

Get-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections

Bypassing examples

Trusted folder

In AppLocker, a Trusted folder is a designated folder or set of folders that are exempt from application control policies. If the default AppLocker rules are applied, you should be able to execute executables from Read/Write/Executable folders within C:\Program Files\ and C:\Windows.

To locate Writeable and executable folder

Using accesschk.exe:

accesschk.exe "student" C:\Windows -wus

Verify they are executable:

icacls.exe C:\Windows\Tasks

Unmanaged DLLs

AppLocker default rule set does not protect against loading arbitrary DLLs.

References

GitHub - milkdevil/UltimateAppLockerByPassListGitHub

UltimateAppLockerByPassList/VerifiedAppLockerBypasses.md at master · api0cradle/UltimateAppLockerByPassListGitHub