This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently.
SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.tech...
AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<)
SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr...
I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).
SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.tech...
AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<)
SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr...
I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).