Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1011290" data-attributes="member: 32260">It could be done, as many other possibilities. But, this would also require a full-fledged application similar to Hard_Configurator or Simple Windows Hardening. For now, I think about something very simple without losing the level of security provided by SAC.Allowing unsigned DLLs in UserSpace is possible with a properly designed (classic) SRP, like with Hard_Configurator settings. The security design provided by Applocker (SRPV2) is different and requires DLL blocking - otherwise, one should block LOLBins to avoid bypassing Applocker.I am not sure for now which option would be more useful for home users. Microsoft has chosen to block DLLs when using SAC.If I correctly recall, only (classic) SRP cannot block .NET DLLs and Applocker (SRPV2) can correctly block them. For example:[URL unfurl=&quot;false&quot;]https://www.linkedin.com/pulse/applocker-bypass-execute-dll-signed-binary-morten-brok[/URL]The author uses .NET DLL (C# ) to bypass Applocker, but the requirement for the bypass is execution from the whitelisted folder.</blockquote>

[QUOTE="Andy Ful, post: 1011290, member: 32260"] It could be done, as many other possibilities. But, this would also require a full-fledged application similar to Hard_Configurator or Simple Windows Hardening. For now, I think about something very simple without losing the level of security provided by SAC. Allowing unsigned DLLs in UserSpace is possible with a properly designed (classic) SRP, like with Hard_Configurator settings. The security design provided by Applocker (SRPV2) is different and requires DLL blocking - otherwise, one should block LOLBins to avoid bypassing Applocker. I am not sure for now which option would be more useful for home users. Microsoft has chosen to block DLLs when using SAC. If I correctly recall, only (classic) SRP cannot block .NET DLLs and Applocker (SRPV2) can correctly block them. For example: [URL unfurl="false"]https://www.linkedin.com/pulse/applocker-bypass-execute-dll-signed-binary-morten-brok[/URL] The author uses .NET DLL (C# ) to bypass Applocker, but the requirement for the bypass is execution from the whitelisted folder. [/QUOTE]

Verification