Bypassing AppLocker with C#
We have successfully bypassed AppLocker’s PowerShell
restrictions and have executed arbitrary managed C#
and PowerShell code through InstallUtil.
However, this relies on the existence of a single binary.
If InstallUtil was blocked by a deny rule,
this technique would fail.
Let’s improve our tradecraft by building another
AppLocker bypass in C#.
In addition to providing an alternative bypass method for C#
code execution, this process demonstrates basic techniques
which could aid future research.
Discovering a bypass is not completely trivial,
so we’ll divide this process into a number of steps.