Bypassing AppLocker with PowerShell
In previous sections we executed simple bypasses.
In the remaining sections, we will investigate advanced
and increasingly complex bypasses and reuse
previously-developed tradecraft
that bypasses non-standard AppLocker rulesets.
Our previously developed tradecraft relied heavily on
PowerShell which, as previously demonstrated,
can easily bypass detection mechanisms like AMSI.
In this section, we will analyze the various restrictions
Applocker places on PowerShell and demonstrate bypasses.