Application Whitelisting
Our analysis of antivirus bypass techniques in a previous module
revealed that AV bypass is fairly straight-forward,
even when using existing tools and frameworks.
However, many organizations improve the security level
of their endpoints with application whitelisting
technology, which employs monitoring software that blocks
all applications except those on a pre-defined whitelist.
This effectively blocks custom applications or code,
including many tools used by an attacker to obtain remote access
or escalate privileges.
In this module, we’ll introduce application whitelisting
and explore a variety of bypass techniques.
We will rely on existing and trusted applications,
in a technique known as “Living off the land”.
Application whitelisting impacts both our ability to obtain
initial code execution as well as subsequent post-exploitation.
In this module, we’ll explore application whitelisting
software installed by default on Microsoft Windows,
which is the most common client endpoint.
We’ll also develop multiple bypasses and demonstrate how
our existing post-exploitation tools can be reused.