A centralized resource for previously documented WDAC/Device Guard/UMCI bypass techniques as well for building/managing/testing WDAC policies
- Note: WDAC (Windows Defender Application Control) has been rebranded by Microsoft as "Application Control" or "Application Control for Business"
*Many of the LOLBINs are included on the Applications that can bypass WDAC List formerly called the "Microsoft Recommended Block Rules List"
Pro Tip: If applying the Block Rules policy, don't forget to remove the first two file rules:ID_ALLOW_A_1andID_ALLOW_A_2
*This repository was inspired by Oddvar Moe's Ultimate AppLocker Bypass List
*As always, this is a work in progress...
- By James Forshaw (@tiraniddo)
- DG on Windows 10 S: Executing Arbitrary Code
- By James Forshaw (@tiraniddo)
- DG on Windows 10 S: Executing Arbitrary Code
- By Unknown (Documented by @McKinleyMike and @TheLatteri)
- Insecure Deserialization in AddinUtil.exe
- By cpl (@cpl3h)
- The Curious Case of Aspnet_Compiler.exe
- By Oddvar Moe (@Oddvarmoe)
- Bypassing Application Whitelisting with BGInfo
- By Matt Graeber (@mattifestation)
- Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
- By Casey Smith (@subTee)
- Application Whitelisting Bypass - CSI.EXE C# Scripting
- By Casey Smith (@subTee)
- dbghost.exe - Ghost And The Darkness
- By Casey Smith (@subTee), Ross Wolf (@rw_access)
- How to Bypass WDAC with dbgsrv.exe
- Fantastic Red-Team Attacks and How to Find Them
- By Matt Nelson (@enigma0x3)
- BYPASSING APPLICATION WHITELISTING BY USING DNX.EXE
- By Jimmy Bayne (@bohops)
- DotNet Core: A Vector For AWL Bypass & Defense Evasion
- By Nick Tyrer (@NickTyrer) [Write-up: Jimmy Bayne (@bohops)]
- GitHub Gist: fsi.exe inline execution
- Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
- By Nick Tyrer (@NickTyrer) via fsi.exe inline execution [Write-up: Jimmy Bayne (@bohops)]
- GitHub Gist: fsi.exe inline execution
- Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
- By Kyle Hanslovan (@KyleHanslovan), Chris Bisnett (@chrisbisnett)
- Evading Autoruns - DerbyCon 7.0
- RE: Evading Autoruns PoCs on Windows 10
- By James Forshaw (@tiraniddo)
- DG on Windows 10 S: Abusing InstallUtil
- By Kim Oppalfens (@TheWMIGuy)
- Intune Windows Agent Bypass Explanation
- By @hyp3rlinx
- Microsoft Process Kill Utility "kill.exe" - SEH Buffer Overflow
- By Matt Graeber (@mattifestation)
- Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe
- By Casey Smith (@subTee)
- Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
- By Unknown (Documented by @conscioushacker)
- Application Whitelisting Bypass: mshta.exe
- By Lasse Trolle Borup (@TrolleBorup)
- A simple Device Guard bypass
- By Matt Nelson (@enigma0x3)
- BYPASSING APPLICATION WHITELISTING BY USING RCSI.EXE
- By Matt Graeber (@mattifestation)
- Bypassing Application Whitelisting with runscripthelper.exe
- By Unknown
- TextTransformer - Tool Use Case [Documented by Casey Smith (@_subTee)]
- TextTransform Shellcode Injection Template [Documented by Chris Sphen (@ConsciousHacker)]
- Placeholder reference (coming soon)
- By Lee Christensen (@tifkin_) [Write-up: Jimmy Bayne (@bohops)]
- Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative
- Tipped by MSRC and Matt Graeber (@mattifestation) [Write-up: Jimmy Bayne (@bohops)]
- Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
- https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
- By Matt Graeber (@mattifestation)
- Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
- By Casey Smith (@subTee)
- WMIC.EXE Whitelisting Bypass - Hacking with Style, Stylesheets
- By Alex Ionescu (@aionescu)
- Fun with the Windows Subsystem for Linux
- dbgsvc.exe
- kd.exe
- ntkd.exe
- ntsd.exe
- HVCIScan.exe
- Microsoft.Build.dll
- Microsoft.Build.Framework.dll
- msbuild.dll
- lxssmanager.dll
- system.management.automation.dll
- webclnt.dll/davsvc.dll
- mfc40.dll
- LOLBAS-Project/LOLBAS#496 (coming soon)
- LOLBAS-Project/LOLBAS#496 (coming soon)
- By Cerbersec (@cerbersec)
- Bypass WDAC WinDbg Preview
- By Matt Nelson (@enigma0x3)
- https://gist.github.com/enigma0x3/22d6fc84956f154faf338966cd6d9bb0
- https://x.com/enigma0x3/status/2100628652664787319
- By Matt Nelson (@enigma0x3)
- https://enigma0x3.net/2017/10/19/umci-bypass-using-psworkflowutility-cve-2017-0215/
- By Matt Nelson (@enigma0x3)
- https://enigma0x3.net/2017/04/03/defeating-device-guard-a-look-into-cve-2017-0007/
- By Matt Graeber (@mattifestation)
- http://www.exploit-monday.com/2017/08/exploiting-powershell-code-injection.html
- By Matt Nelson (@enigma0x3)
- https://enigma0x3.net/2017/11/06/a-look-at-cve-2017-8715-bypassing-cve-2017-0218-using-powershell-module-manifests/
- By Matt Nelson (@enigma0x3)
- https://enigma0x3.net/2018/10/10/cve-2018-8212-device-guard-clm-bypass-using-msft_scriptresource/
- By Matt Graeber (@mattifestation)
- https://twitter.com/mattifestation/status/1095416185053696000
Novel Living-Of-The-Land/COM/Microsoft Office/Active Scripting Languages (jscript.dll, msxml3.dll, msxml6.dll)
- By Matt Graeber (@mattifestation)
- http://www.exploit-monday.com/2017/07/bypassing-device-guard-with-dotnet-methods.html
- By Philip Tsukerman (@PhilipTsukerman)
- https://conference.hitb.org/hitbsecconf2019ams/materials/D2T1%20-%20Sneaking%20Past%20Device%20Guard%20-%20Philip%20Tsukerman.pdf
- By James Forshaw (@tiraniddo)
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1514&q=
- By Matt Nelson (@enigma0x3)
- https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/
- By Matt Graeber (@mattifestation)
- https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404
- By Jimmy Bayne (@bohops)
- https://bohops.com/2019/01/10/com-xsl-transformation-bypassing-microsoft-application-control-solutions-cve-2018-8492/
- By Jimmy Bayne (@bohops)
- https://bohops.com/2019/05/04/abusing-catalog-file-hygiene-to-bypass-application-whitelisting/
- By Oddvar Moe (@Oddvarmoe), Matt Nelson (@enigma0x3)
- https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/
- By Matt Nelson (@enigma0x3)
- https://enigma0x3.net/2017/08/24/umci-vs-internet-explorer-exploring-cve-2017-8625/
- By William Easton (@strawgate)
- https://github.com/strawgate/Advisories/blob/main/Microsoft/VULN-051861.md
- By Bobby Cooke (0xBoku)
- https://www.ibm.com/think/x-force/bypassing-windows-defender-application-control-loki-c2
- By Valentina Palmiotti (@chompie1337)
- https://www.ibm.com/think/x-force/operationalizing-browser-exploits-to-bypass-wdac
- Excellent blog for App Control/WDAC management, deployment strategies, and overcoming gaps and risks
- By Kim Oppalfens (@TheWMIGuy)
- https://www.appcontrol.ai/blog
- Fantastic videos collection that covers WDAC Policy Creation/Enforcement/Bypass/Audit/Etc.
- By Matt Graeber (@mattifestation)
- https://www.youtube.com/playlist?list=PL2Xx-q-W5pKUNaNkakjZkLmfsNvMWPdNB
- Documentation and tools to access Windows Defender Application Control (WDAC) technology
- By Microsoft Docs
- https://github.com/MicrosoftDocs/WDAC-Toolkit
- A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies
- By Matt Graeber (@mattifestation)
- https://github.com/mattifestation/WDACTools
- A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies
- By Matt Graeber (@mattifestation)
- https://github.com/mattifestation/WDACPolicies
- By FortyNorth Security (@FortyNorthSec)
- https://fortynorthsecurity.com/blog/building-a-windows-defender-application-control-lab/
Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology
- By Matt Graeber (@mattifestation)
- https://posts.specterops.io/documenting-and-attacking-a-windows-defender-application-control-feature-the-hard-way-a-case-73dd1e11be3a
- Windows Application Control Notes and Sample Policies
- By Brian in Pittsburgh (@arekfurt)
- https://github.com/arekfurt/WinAWL
- By Matt Graeber (@mattifestation)
- http://www.exploit-monday.com/
- By Jimmy Bayne (@bohops)
- Restrictive Policy: https://gist.github.com/bohops/bd763d87187b79c0c749da6be7be8a42
- Scan Policy: https://gist.github.com/bohops/148375490c5ead713ed8a433b466182f
Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure Windows-only Policy
- By Matt Graeber (@mattifestation)
- https://mattifestation.medium.com/windows-defender-application-control-wdac-updates-in-20h2-and-building-a-simple-secure-4fd4ee86de4
- By HotCakeX (@HotCakeX)
- https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes
- By Chad Duffey (@duff22b)
- https://www.chadduffey.com/wdac/2021/01/26/WDAC-notes.html