Cybercrime Security Forum - Europe 2018 Session

1. Implementing Gartners #1 Security measure for 2018 - Whitelisting

2. About me
Security Architect, Sovereign Wealth Fund
Blue Teamer
Azure / AWS / Windows
KarimElMelhaoui

3. There is no silver bullet in information
security, but if managed correctly
application whitelisting solutions at
the endpoint provide exceptional
protection from zero day and
targeted attacks.
Why

4. Application whitelisting is hard to implement
It breaks system/application X
The administrative overhead is too high
Common excuses

5. The History of Application Whitelisting
Software Restriction Policies

6. The History of Application Whitelisting
AppLocker

7. The History of Application Whitelisting
Windows Defender
Application Control

8. • User Write-able directories
• Safe Paths (AccessChk.exe)
• Default rules
• DLL rules
• Constrained Language mode
Application whitelisting –Basics and concepts

9. Demo – AppLocker default rules

10. Bypassing AppLocker

11. Bypassing AppLocker

12. Bypassing AppLocker - Mitigation

13. Bypassing AppLocker - Mitigation

14. Bypassing AppLocker - Mitigation

15. Bypassing AppLocker - Mitigation

16. Bypassing AppLocker - Mitigation

17. AaronLocker – Fundamentals

18. AaronLocker – Fundamentals

19. Demo – Configuring AppLocker
with “AaronLocker”

20. Packer overview
• Builds “Golden images”
• Builders
• VMware, Hyper-V..
• AWS/Azure/GCP/AliBaba
• Provisioners – Chef, Puppet, Ansible, PowerShell, Bash…

21. • “Immutable” servers – Cattle, not pets
• Dynamic configuration
• No keyboard principle
Embedding AppLocker policies in Server Build

22. Demo – Embedding AppLocker
in Server Build process

23. PAL overview
Invoke-PALExploitableRules
• Finds all rules that can be exploited
Invoke-PALCLMTempBypass

24. Bypassing AppLocker
.. As mentioned in Panel, it can be bypassed
• Paths
• Digital Signature
• CLM bypasses

25. Demo – Bypassing AppLocker
and PowerShell CLM

26. Identify
Develop rules
Maintain
Summary

27. Summary

28. Aaron Margosis, Microsoft
Oddvar Moe, TrustedSec
Sami Laiho, Emotional Support
Credits