api0cradle / UltimateAppLockerByPassList

The goal of this repository is to document the most common techniques to bypass AppLocker.
1.91k stars 353 forks source link

fix some quote and paren issues #17

Open clr2of8 opened 4 years ago

clr2of8 commented 4 years ago

Also, during an inquiry about this technique on latest Win10 I got this response from Matt Graeber (mattifestation)

The EXE version in Win 10 will no longer work. I forget in which build they updated it but it was rewritten and no longer parses PowerShell from the command line. The .vbs works because it passes PowerShell args to the Sync-AppvPublishingServer cmdlet by calling powershell.exe. In other words, SyncAppvPublishingServer is no longer a viable lolbin.

Do you know what build the change occurred? Perhaps notes could be added to the MD about this topic.