Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1011467" data-attributes="member: 32260">Allowing DLLs in UserSpace means that your protection can be bypassed via DLL hijacking. Here are some examples in the wild:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-945840[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-974122[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-978585[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-985951[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-988985[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-995348[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/simple-windows-hardening.102265/post-998128[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1001945[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1007070[/URL]So, you can use your Applocker setup, remembering about those vulnerabilities (archives, disk images, HTML smuggling, etc.).Many of these attacks can be prevented by allowing DLLs only in the AppData\Local folder:%OSDRIVE%\Users\*\AppData\Local\*&nbsp;&nbsp; (or %OSDRIVE%\Users\*\AppData\Local\Temp\*).[CODE]&nbsp; &nbsp; &lt;FilePathRule Id=&quot;068c7caf-8542-400b-ae91-f9f59b113f72&quot; Name=&quot;%OSDRIVE%\Users\*\AppData\Local\Temp\*&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Allow&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePathCondition Path=&quot;%OSDRIVE%\Users\*\AppData\Local\Temp\*&quot; /&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePathRule&gt;[/CODE]Sometimes is necessary to allow DLLs also in the ProgramData folder.Do not forget to allow DLLs in %WinDir% and %ProgramFiles%.</blockquote>

[QUOTE="Andy Ful, post: 1011467, member: 32260"] Allowing DLLs in UserSpace means that your protection can be bypassed via DLL hijacking. Here are some examples in the wild: [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-945840[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-974122[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-978585[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-985951[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-988985[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-995348[/URL] [URL unfurl="false"]https://malwaretips.com/threads/simple-windows-hardening.102265/post-998128[/URL] [URL unfurl="false"]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1001945[/URL] [URL unfurl="false"]https://malwaretips.com/threads/testing-dll-search-order-hijacking-against-security-features.101171/post-1007070[/URL] So, you can use your Applocker setup, remembering about those vulnerabilities (archives, disk images, HTML smuggling, etc.). Many of these attacks can be prevented by allowing DLLs only in the AppData\Local folder: %OSDRIVE%\Users\*\AppData\Local\* (or %OSDRIVE%\Users\*\AppData\Local\Temp\*). [CODE] <FilePathRule Id="068c7caf-8542-400b-ae91-f9f59b113f72" Name="%OSDRIVE%\Users\*\AppData\Local\Temp\*" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%OSDRIVE%\Users\*\AppData\Local\Temp\*" /> </Conditions> </FilePathRule> [/CODE] Sometimes is necessary to allow DLLs also in the ProgramData folder. Do not forget to allow DLLs in %WinDir% and %ProgramFiles%. [/QUOTE]

Verification