Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

of

App-o-Lockalypse now! Slide 1 App-o-Lockalypse now! Slide 2 App-o-Lockalypse now! Slide 3 App-o-Lockalypse now! Slide 4 App-o-Lockalypse now! Slide 5 App-o-Lockalypse now! Slide 6 App-o-Lockalypse now! Slide 7 App-o-Lockalypse now! Slide 8 App-o-Lockalypse now! Slide 9 App-o-Lockalypse now! Slide 10 App-o-Lockalypse now! Slide 11 App-o-Lockalypse now! Slide 12 App-o-Lockalypse now! Slide 13 App-o-Lockalypse now! Slide 14 App-o-Lockalypse now! Slide 15 App-o-Lockalypse now! Slide 16 App-o-Lockalypse now! Slide 17 App-o-Lockalypse now! Slide 18 App-o-Lockalypse now! Slide 19 App-o-Lockalypse now! Slide 20 App-o-Lockalypse now! Slide 21 App-o-Lockalypse now! Slide 22 App-o-Lockalypse now! Slide 23 App-o-Lockalypse now! Slide 24 App-o-Lockalypse now! Slide 25 App-o-Lockalypse now! Slide 26 App-o-Lockalypse now! Slide 27 App-o-Lockalypse now! Slide 28 App-o-Lockalypse now! Slide 29 App-o-Lockalypse now! Slide 30 App-o-Lockalypse now! Slide 31 App-o-Lockalypse now! Slide 32 App-o-Lockalypse now! Slide 33 App-o-Lockalypse now! Slide 34 App-o-Lockalypse now! Slide 35 App-o-Lockalypse now! Slide 36 App-o-Lockalypse now! Slide 37 App-o-Lockalypse now! Slide 38 App-o-Lockalypse now! Slide 39 App-o-Lockalypse now! Slide 40 App-o-Lockalypse now! Slide 41 App-o-Lockalypse now! Slide 42 App-o-Lockalypse now! Slide 43 App-o-Lockalypse now! Slide 44 App-o-Lockalypse now! Slide 45 App-o-Lockalypse now! Slide 46 App-o-Lockalypse now! Slide 47 App-o-Lockalypse now! Slide 48 App-o-Lockalypse now! Slide 49 App-o-Lockalypse now! Slide 50 App-o-Lockalypse now! Slide 51 App-o-Lockalypse now! Slide 52 App-o-Lockalypse now! Slide 53 App-o-Lockalypse now! Slide 54 App-o-Lockalypse now! Slide 55 App-o-Lockalypse now! Slide 56 App-o-Lockalypse now! Slide 57 App-o-Lockalypse now! Slide 58
Upcoming SlideShare
What to Upload to SlideShare
Next
Download to read offline and view in fullscreen.

3 Likes

Share

Download to read offline

App-o-Lockalypse now!

Download to read offline

Slides from session at Derbycon 8.0.
Description:
Want to get a good overview of AppLocker and the different AppLocker bypasses and at the same time learn how defenders can harden their environments to prevent them? Then this is a talk you don't want to miss. This talk will cover a vast amount of bypass techniques and how to harden AppLocker to make it even harder to bypass. Giving you help to either start or avoid an App-o-Lockalypse.

Related Books

Free with a 30 day trial from Scribd

See all

Related Audiobooks

Free with a 30 day trial from Scribd

See all

App-o-Lockalypse now!

  1. 1. Can also use Mklink /H
  2. 2. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc783530(v=ws.10)
  3. 3. https://gist.github.com/api0cradle/563226464376d40e191ce53abcf9c4d0
  4. 4. $CurrTemp = $env:temp $CurrTmp = $env:tmp $TEMPBypassPath = "C:windowstemp" $TMPBypassPath = "C:windowstemp" Set-ItemProperty -Path 'hkcu:Environment' -Name Tmp -Value "$TEMPBypassPath" Set-ItemProperty -Path 'hkcu:Environment' -Name Temp -Value "$TMPBypassPath" Invoke-WmiMethod -Class win32_process -Name create -ArgumentList "powershell" sleep 5 #Set it back Set-ItemProperty -Path 'hkcu:Environment' -Name Tmp -Value $CurrTmp Set-ItemProperty -Path 'hkcu:Environment' -Name Temp -Value $CurrTemp
  • gtin00b

    Jun. 3, 2020
  • OOIIOO

    Nov. 2, 2018
  • evandrix

    Oct. 7, 2018

Slides from session at Derbycon 8.0. Description: Want to get a good overview of AppLocker and the different AppLocker bypasses and at the same time learn how defenders can harden their environments to prevent them? Then this is a talk you don't want to miss. This talk will cover a vast amount of bypass techniques and how to harden AppLocker to make it even harder to bypass. Giving you help to either start or avoid an App-o-Lockalypse.

Views

Total views

1,157

On Slideshare

0

From embeds

0

Number of embeds

0

Actions

Downloads

31

Shares

0

Comments

0

Likes

3

×