https://github.com/api0cradle/UltimateAppLockerByPassList

The goal of this repository is to document the most common techniques to bypass AppLocker.
https://github.com/api0cradle/UltimateAppLockerByPassList

applocker awl blueteam bypass purpleteam redteam rules

Last synced: about 1 month ago
JSON representation

The goal of this repository is to document the most common techniques to bypass AppLocker.

• Host: GitHub
• URL: https://github.com/api0cradle/UltimateAppLockerByPassList
• Owner: api0cradle
• Created: 2017-07-11T20:36:42.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2023-09-11T20:43:25.000Z (over 1 year ago)
• Last Synced: 2024-10-29T17:39:52.169Z (about 1 month ago)
• Topics: applocker, awl, blueteam, bypass, purpleteam, redteam, rules
• Language: PowerShell
• Size: 679 KB
• Stars: 1,906
• Watchers: 118
• Forks: 354
• Open Issues: 8
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-hacking-lists - api0cradle/UltimateAppLockerByPassList - The goal of this repository is to document the most common techniques to bypass AppLocker. (PowerShell)

README

        
# Ultimate AppLocker ByPass List

The goal of this repository is to document the most common and known techniques to bypass AppLocker. 

Since AppLocker can be configured in different ways I maintain a verified list of bypasses (that works against the default AppLocker rules) and a list with possible bypass technique (depending on configuration) or claimed to be a bypass by someone. 

I also have a list of generic bypass techniques as well as a legacy list of methods to execute through DLLs.

   

   

   

## INDEXED LISTS

* [Generic-AppLockerbypasses.md](Generic-AppLockerbypasses.md)

* [VerifiedAppLockerBypasses.md](VerifiedAppLockerBypasses.md)

* [UnverifiedAppLockerBypasses.md](UnverifiedAppLockerBypasses.md)

* [DLL-Execution.md](DLL-Execution.md)

   

   

   

## YML

I have also created everything in YML format so it the data can be reused.

The YML files can be found under the YML folder. 

      

     

     

For details on how I verified and how to create the default rules you can check my blog: 

https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/  

## BLOCK RULES

The rules can be found in the AppLocker-BlockPolicies folder.

   

    

Please contribute and do point out errors or resources I have forgotten.

## Other tools

Remember to check out my Powershell module called PowerAL: https://github.com/api0cradle/PowerAL

This can help you identify weaknesses