02. AppLockwork Orange by Grzegorz Tworek

AppLocker Architecture Review

Grzegorz Tworek (introduced as Greg) presents AppLockwork Orange at x33fcon, motivated by prior AppLocker deployments. AppLocker combines user-mode policy via AppIDSvc with kernel enforcement through a driver, supporting path, hash, and publisher rules in audit or enforce modes for executables, scripts, and DLLs.

Unexpected Enforcement Gaps

Tworek highlights internal behaviors that produce surprising results. Processes carrying the SeTcbPrivilege token bypass AppLocker entirely—no block, audit, or log entry—making privileged-token monitoring important. Teams often deploy executable rules first and skip DLL rules for simplicity, leaving blind spots.

Hash Rule Weaknesses

Hash-based allow rules trust file content, but offline VHD manipulation shows an attacker can alter bytes after hashing while the rule still permits execution if the hash was captured earlier. He also compares extended attributes to alternate data streams on steroids, demonstrating how metadata manipulation interacts with enforcement logging.