Loading Alternate Data Stream (ADS) DLL/CPL Binaries to Bypass AppLocker
#Security Testing#Offensive Security
A project for demonstrating AWS attack techniques with a focus on ethical hacking practices.
A Technique Utilizing Alternate Data Streams for AppLocker Bypass
This technique uses Alternate Data Streams (ADS) to circumvent the default policies of AppLocker. It achieves this by loading DLL/CPL binaries through various methods of invocation, such as wmic, start, rundll32, and others. This approach takes advantage of the capability of low privileged security groups to write to certain files and directories.
