Application control is a powerful technique…but only if you use it wisely. A single weak or misconfigured rule can open the door for attackers.
I’ve seen this first hand during internal pentests.
One time, the client had locked down their endpoint really well. I was struggling to find any way to get my tools running.
But then I noticed they had a rule that allowed a specific binary by name. This binary no longer existed on the system. So guess what I did?
I ran all my tools as oldbinary.exe.
It takes time and effort to continuously tune and maintain your application control tools, but I promise you it’s worth it.
Here are the 3 application control rules you should never break:
1) Avoid drive roots (like C:\), user-writable folders, wildcards (*), or UNC paths. Attackers look to drop malware where your rules are weakest.
2) If you allow “any binary” from a publisher or forget to set an upper version bound, you’re letting attackers have the upper hand, by allowing any version of the software.
3) Avoid assigning rules to Domain Users, Everyone, Authenticated Users, or BUILTIN\Users. You might as well not use application control if that’s the case.
This is just a starting point really. These are three of the most dangerous mistakes, but there are certainly many others.
By the way, these rules apply no matter tool what you’re using: AppLocker, WDAC, MagicSword, ThreatLocker.
Now I want to leave you with some free resources.
AppLocker Inspector, written by me, can be used to audit policies for weak, misconfigured and dangerous settings.
AppLockerGen, written by the awesome Michael Haag, simplifies the process of generating AppLocker XML policies, providing a user-friendly interface to create, merge, and manage rules effectively.
LOLBASLine, again by Michael Haag, is cool because it can be used to assess the presence and execution capabilities of Living Off The Land Binaries and Scripts (LOLBAS) on Windows systems.
I see misconfigured application control products all the time during internal pentests. I’ve become quite good at testing and evaluating the effectiveness of those tools. If you’d like help, book a call and lets chat about it.
All the best
Spencer
PS - Remember, attackers don’t need all your rules to fail…just one. Audit your application control rules.