Added Microsoft.Workflow.Compiler.exe as a blocked .net binary

microsoft / AaronLocker

Robust and practical application control for Windows

MIT License

595 stars 72 forks source link

Added Microsoft.Workflow.Compiler.exe as a blocked .net binary #2

Closed api0cradle closed 5 years ago

api0cradle commented 5 years ago

Binary can be used to bypass whitelisting.

More info here: https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb

AaronMargosis commented 5 years ago

Sorry for not getting on this sooner - I didn't have notifications set up correctly and didn't know about this PR. I've confirmed that it's a bypass and will probably take it but am doing research on the purpose for and usage of the tool and what the potential side effects might be.