bohops/UltimateWDACBypassList

# WDAC Bypass 终极列表 一个集中式的资源库，用于汇总此前已记录的 WDAC/Device Guard/UMCI bypass 技术以及用于构建/管理/测试 WDAC 策略的方法。 - 注意：WDAC (Windows Defender Application Control) 已被 Microsoft 更名为 "Application Control" 或 "Application Control for Business" *许多 LOLBIN 包含在[可绕过 WDAC 的应用程序列表](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac)中，该列表此前被称为 "Microsoft 推荐的阻止规则列表"。 - `专业提示`：如果应用阻止规则策略，请不要忘记移除前两个文件规则：`ID_ALLOW_A_1` 和 `ID_ALLOW_A_2` *此仓库的灵感来源于 [Oddvar Moe](https://twitter.com/Oddvarmoe) 的 [AppLocker Bypass 终极列表](https://github.com/api0cradle/UltimateAppLockerByPassList) *与以往一样，本仓库仍在不断构建中... ### 可绕过 WDAC 的应用程序 - "LOLBIN" 分析文章 #### addinprocess.exe - 作者：James Forshaw (@tiraniddo) - DG on Windows 10 S: Executing Arbitrary Code - https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html #### addinprocess32.exe - 作者：James Forshaw (@tiraniddo) - DG on Windows 10 S: Executing Arbitrary Code - https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html #### addinutil.exe - 作者：未知 (由 @McKinleyMike 和 @TheLatteri 记录) - Insecure Deserialization in AddinUtil.exe - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html #### aspnet_compiler.exe - 作者：cpl (@cpl3h) - The Curious Case of Aspnet_Compiler.exe - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ #### bginfo.exe - 作者：Oddvar Moe (@Oddvarmoe) - Bypassing Application Whitelisting with BGInfo - https://msitpros.com/?p=3831 #### cdb.exe - 作者：Matt Graeber (@mattifestation) - Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner - http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html #### csi.exe - 作者：Casey Smith (@subTee) - Application Whitelisting Bypass - CSI.EXE C# Scripting - https://web.archive.org/web/20161008143428/http://subt0x10.blogspot.com/2016/09/application-whitelisting-bypass-csiexe.html #### dbghost.exe - 作者：Casey Smith (@subTee) - dbghost.exe - Ghost And The Darkness - https://web.archive.org/web/20170926164017/http://subt0x10.blogspot.com/2017/09/dbghostexe-ghost-in-darkness.html #### dbgsrv.exe - 作者：Casey Smith (@subTee), Ross Wolf (@rw_access) - How to Bypass WDAC with dbgsrv.exe - https://fortynorthsecurity.com/blog/how-to-bypass-wdac-with-dbgsrv-exe/ - Fantastic Red-Team Attacks and How to Find Them - https://i.blackhat.com/USA-19/Thursday/us-19-Smith-Fantastic-Red-Team-Attacks-And-How-To-Find-Them.pdf #### dnx.exe - 作者：Matt Nelson (@enigma0x3) - BYPASSING APPLICATION WHITELISTING BY USING DNX.EXE - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/ #### dotnet.exe - 作者：Jimmy Bayne (@bohops) - DotNet Core: A Vector For AWL Bypass & Defense Evasion - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/ #### fsi.exe - 作者：Nick Tyrer (@NickTyrer) [分析文章：Jimmy Bayne (@bohops)] - GitHub Gist: fsi.exe inline execution - https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1 - https://twitter.com/NickTyrer/status/904273264385589248 - Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ #### fsiAnyCpu.exe - 作者：Nick Tyrer (@NickTyrer) 通过 fsi.exe inline execution [分析文章：Jimmy Bayne (@bohops)] - GitHub Gist: fsi.exe inline execution - https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1 - https://twitter.com/bohops/status/1319096336441090050 - Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ #### infdefaultinstall.exe - 作者：Kyle Hanslovan (@KyleHanslovan), Chris Bisnett (@chrisbisnett) - Evading Autoruns - DerbyCon 7.0 - https://github.com/huntresslabs/evading-autoruns - RE: Evading Autoruns PoCs on Windows 10 - https://medium.com/@KyleHanslovan/re-evading-autoruns-pocs-on-windows-10-dd810d7e8a3f #### InstallUtil.exe - 作者：James Forshaw (@tiraniddo) - DG on Windows 10 S: Abusing InstallUtil - https://www.tiraniddo.dev/2017/08/dg-on-windows-10-s-abusing-installutil.html #### IntuneWindowsAgent.exe (Microsoft.Management.Services.IntuneWindowsAgent.exe) - 作者：Kim Oppalfens (@TheWMIGuy) - Intune Windows Agent Bypass Explanation - https://github.com/bohops/UltimateWDACBypassList/issues/1 #### kill.exe - 作者：@hyp3rlinx - Microsoft Process Kill Utility "kill.exe" - SEH Buffer Overflow - http://hyp3rlinx.altervista.org/advisories/MS-KILL-UTILITY-BUFFER-OVERFLOW.txt - https://twitter.com/bohops/status/1324563760967753730 #### microsoft.Workflow.Compiler.exe - 作者：Matt Graeber (@mattifestation) - Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb #### msbuild.exe - 作者：Casey Smith (@subTee) - Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations - https://web.archive.org/web/20160920161634/http://subt0x10.blogspot.com/2016/09/bypassing-application-whitelisting.html #### mshta.exe - 作者：未知 (由 @conscioushacker 记录) - Application Whitelisting Bypass: mshta.exe - https://web.archive.org/web/20171118145940/http://blog.conscioushacker.io/index.php/2017/11/17/application-whitelisting-bypass-mshta-exe/ #### powershellcustomhost.exe - 作者：Lasse Trolle Borup (@TrolleBorup) - A simple Device Guard bypass - https://danishcyberdefence.dk/blog/device-guard-powershellcustomhost #### rcsi.exe - 作者：Matt Nelson (@enigma0x3) - BYPASSING APPLICATION WHITELISTING BY USING RCSI.EXE - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/ #### runscripthelper.exe - 作者：Matt Graeber (@mattifestation) - Bypassing Application Whitelisting with runscripthelper.exe - https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc #### texttransform.exe - 作者：未知 (由 Casey Smith (_subTee) 记录) - TextTransformer (Tool Use Case) - https://github.com/secdev02/TextTransformer - 占位参考（即将推出） #### visualuiaverifynative.exe - 作者：Lee Christensen (@tifkin_) [分析文章：Jimmy Bayne (@bohops)] - Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/ #### wfc.exe - 由 MSRC 和 Matt Graeber (@mattifestation) 提示 [分析文章：Jimmy Bayne (@bohops)] - Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ #### windbg.exe - 作者：Matt Graeber (@mattifestation) - Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner - http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html #### wmic.exe - 作者：Casey Smith (@subTee) - WMIC.EXE Whitelisting Bypass - Hacking with Style, Stylesheets - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html #### WSL 家族 - bash.exe, lxrun.exe, wsl.exe, wslconfig.exe, wslhost.exe - 作者：Alex Ionescu (@aionescu) - Fun with the Windows Subsystem for Linux - https://github.com/ionescu007/lxss #### 位于阻止列表 - 尚未被记录... - dbgsvc.exe - kd.exe - ntkd.exe - ntsd.exe - HVCIScan.exe #### 列表中的库（独立使用可能有趣/也可能无趣） - Microsoft.Build.dll - Microsoft.Build.Framework.dll - msbuild.dll - lxssmanager.dll - system.management.automation.dll - webclnt.dll/davsvc.dll - mfc40.dll ### 其他“未签名代码执行”的 LOLBIN（不在列表中） #### texttransformcore.exe - 占位参考（即将推出） #### microsoft.xsldebugger.host.exe - 占位参考（即将推出） #### WinDbgX.exe - 作者：Cerbersec (@cerbersec) - Bypass WDAC WinDbg Preview - https://cerbersec.com/2025/04/07/bypass-wdac-windbg-preview.html ### PowerShell #### 使用 PSWORKFLOWUTILITY 绕过 UMCI：CVE-2017-0215 - 作者：Matt Nelson (@enigma0x3) - https://enigma0x3.net/2017/10/19/umci-bypass-using-psworkflowutility-cve-2017-0215/ #### 攻破 Device Guard：深入解析 CVE-2017-0007 - 作者：Matt Nelson (@enigma0x3) - https://enigma0x3.net/2017/04/03/defeating-device-guard-a-look-into-cve-2017-0007/ #### 利用 PowerShell 代码注入漏洞绕过 Constrained Language Mode - 作者：Matt Graeber (@mattifestation) - http://www.exploit-monday.com/2017/08/exploiting-powershell-code-injection.html #### 深入解析 CVE-2017-8715：使用 POWERSHELL MODULE MANIFESTS 绕过 CVE-2017-0218 - 作者：Matt Nelson (@enigma0x3) - https://enigma0x3.net/2017/11/06/a-look-at-cve-2017-8715-bypassing-cve-2017-0218-using-powershell-module-manifests/ #### CVE-2018-8212：使用 MSFT_SCRIPTRESOURCE 绕过 GUARD/CLM - 作者：Matt Nelson (@enigma0x3) - https://enigma0x3.net/2018/10/10/cve-2018-8212-device-guard-clm-bypass-using-msft_scriptresource/ #### Invoke-History Constrained Language Mode 绕过 - 作者：Matt Graeber (@mattifestation) - https://twitter.com/mattifestation/status/1095416185053696000 ### 新型 Living-Of-The-Land/COM/Microsoft Office/Active Scripting Languages (jscript.dll, msxml3.dll, msxml6.dll) #### 使用 .NET Assembly Compilation Methods 绕过 Device Guard - 作者：Matt Graeber (@mattifestation) - http://www.exploit-monday.com/2017/07/bypassing-device-guard-with-dotnet-methods.html #### 悄悄绕过 Device Guard（+ CVE-2018-8417） - 作者：Philip Tsukerman (@PhilipTsukerman) - https://conference.hitb.org/hitbsecconf2019ams/materials/D2T1%20-%20Sneaking%20Past%20Device%20Guard%20-%20Philip%20Tsukerman.pdf #### WLDP CLSID 策略 .NET COM 实例化 UMCI 绕过 - 作者：James Forshaw (@tiraniddo) - https://bugs.chromium.org/p/project-zero/issues/detail?id=1514&q= #### WSH 注入：案例研究 - 作者：Matt Nelson (@enigma0x3) - https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/ #### winrm.vbs 中的 Application Whitelisting 绕过与任意未签名代码执行技术 - 作者：Matt Graeber (@mattifestation) - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404 #### COM XSL 转换：绕过 Microsoft Application Control 解决方案 (CVE-2018-8492) - 作者：Jimmy Bayne (@bohops) - https://bohops.com/2019/01/10/com-xsl-transformation-bypassing-microsoft-application-control-solutions-cve-2018-8492/ #### 滥用 Catalog Hygiene 以绕过 Application Whitelisting - 作者：Jimmy Bayne (@bohops) - https://bohops.com/2019/05/04/abusing-catalog-file-hygiene-to-bypass-application-whitelisting/ #### 使用 CHM 绕过 DEVICE GUARD UMCI – CVE-2017-8625 - 作者：Oddvar Moe (@Oddvarmoe), Matt Nelson (@enigma0x3) - https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/ #### UMCI 对抗 INTERNET EXPLORER：深入解析 CVE-2017-8625 - 作者：Matt Nelson (@enigma0x3) - https://enigma0x3.net/2017/08/24/umci-vs-internet-explorer-exploring-cve-2017-8625/ #### 使用已签名的 Script Hosts 早期版本和 Signature Catalog Files 绕过 WDAC - 作者：William Easton (@strawgate) - https://github.com/strawgate/Advisories/blob/main/Microsoft/VULN-051861.md ### 新型利用/Bring Your Own Vulnerable Application (BYVA) #### 使用 Loki C2 绕过 Windows Defender Application Control（通过 NodeJS-Electron Apps） - 作者：Bobby Cooke (0xBoku) - https://www.ibm.com/think/x-force/bypassing-windows-defender-application-control-loki-c2 #### 将浏览器漏洞利用操作化以绕过 Windows Defender Application Control (WDAC) - 作者：Valentina Palmiotti (@chompie1337) - https://www.ibm.com/think/x-force/operationalizing-browser-exploits-to-bypass-wdac ### 防御、策略创建、测试与研究 #### WDAC Twitch 直播 - 涵盖了 WDAC 策略创建/执行/Bypass/审计等内容的精彩视频合集。 - 作者：Matt Graeber (@mattifestation) - https://www.youtube.com/playlist?list=PL2Xx-q-W5pKUNaNkakjZkLmfsNvMWPdNB #### WDAC Policy Wizard - 用于访问 Windows Defender Application Control (WDAC) 技术的文档和工具 - 作者：Microsoft Docs - https://github.com/MicrosoftDocs/WDAC-Toolkit #### WDACTools - 一个用于促进 Windows Defender Application Control (WDAC) 策略构建、配置、部署和审计的 PowerShell 模块 - 作者：Matt Graeber (@mattifestation) - https://github.com/mattifestation/WDACTools #### WDACPolicies - 包含 Windows 软件基线笔记及相应 Windows Defender Application Control (WDAC) 策略的合集 - 作者：Matt Graeber (@mattifestation) - https://github.com/mattifestation/WDACPolicies #### 构建 Windows Defender Application Control 实验室 - 作者：FortyNorth Security (@FortyNorthSec) - https://fortynorthsecurity.com/blog/building-a-windows-defender-application-control-lab/ #### 以硬核方式记录并攻击 Windows Defender Application Control 功能 — 安全研究方法论案例 - 作者：Matt Graeber (@mattifestation) - https://posts.specterops.io/documenting-and-attacking-a-windows-defender-application-control-feature-the-hard-way-a-case-73dd1e11be3a #### WinAWL - Windows Application Control 笔记与示例策略 - 作者：Brian in Pittsburgh (@arekfurt) - https://github.com/arekfurt/WinAWL #### Exploit Monday 博客 - 作者：Matt Graeber (@mattifestation) - http://www.exploit-monday.com/ #### 部署策略和设置 WDAC 测试机的快速步骤 - 作者：Jimmy Bayne (@bohops) - Restrictive Policy: https://gist.github.com/bohops/bd763d87187b79c0c749da6be7be8a42 - Scan Policy: https://gist.github.com/bohops/148375490c5ead713ed8a433b466182f #### 20H2 中的 Windows Defender Application Control (WDAC) 更新以及构建一个简单、安全的仅限 Windows 的策略 - 作者：Matt Graeber (@mattifestation) - https://mattifestation.medium.com/windows-defender-application-control-wdac-updates-in-20h2-and-building-a-simple-secure-4fd4ee86de4 #### 强化 Windows 安全：WDAC 笔记 - 作者：HotCakeX (@HotCakeX) - https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes #### WDAC 笔记 - 作者：Chad Duffey (@duff22b) - https://www.chadduffey.com/wdac/2021/01/26/WDAC-notes.html

标签：AI合规, API接口, DNS 反向解析, LOLBIN, 多人体追踪, 安全 bypass, 安全资源库, 应用控制, 数据展示, 知识库安全, 红队