Skip to content
KitploitKITPLOIT
OutilsBlog
Soumettre
OutilsBlog
Soumettre

Outils de Hacking, PenTest et Cybersécurité pour votre Arsenal de Sécurité !

Kitploit est un répertoire d'outils de hacking, de cybersécurité et de pentesting. Découvrez les dernières mises à jour des projets pour trouver des vulnérabilités, analyser des systèmes, automatiser les tests et renforcer votre sécurité.

··Flux·Contact·Confidentialité·© 2026 Kitploit

Répertoire d'outils

Catégories

Voir toutes les catégories
Loading categories
Outils/GitHubGitHub/bohops/ultimatewdacbypasslist
Defensive ToolsExploitationConfiguration AuditingPapers & ResearchLearning & EducationRed TeamingCurated Resources
GitHubbohops/ultimatewdacbypasslist

UltimateWDACBypassList

A centralized resource for previously documented WDAC bypass techniques

Voir le dépôt
63185il y a 23 joursVérifié par Kitploit

Populaires

Voir tout →

Découvrez les outils les plus utilisés par notre communauté.

Explorer tous les outils

Parcourez notre collection d'outils

Voir tous les outils →
Partager
Contenu non disponible dans la langue demandée. Affichage de la version anglaise.

Ultimate WDAC Bypass List

A centralized resource for previously documented WDAC/Device Guard/UMCI bypass techniques as well for building/managing/testing WDAC policies

  • Note: WDAC (Windows Defender Application Control) has been rebranded by Microsoft as "Application Control" or "Application Control for Business"

*Many of the LOLBINs are included on the Applications that can bypass WDAC List formerly called the "Microsoft Recommended Block Rules List"

  • Pro Tip: If applying the Block Rules policy, don't forget to remove the first two file rules: ID_ALLOW_A_1 and ID_ALLOW_A_2

*This repository was inspired by Oddvar Moe's Ultimate AppLocker Bypass List

*As always, this is a work in progress...

Applications that can bypass WDAC - "LOLBIN" Write-Ups

addinprocess.exe

  • By James Forshaw (@tiraniddo)
  • DG on Windows 10 S: Executing Arbitrary Code
    • https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html

addinprocess32.exe

  • By James Forshaw (@tiraniddo)
  • DG on Windows 10 S: Executing Arbitrary Code
    • https://www.tiraniddo.dev/2017/07/dg-on-windows-10-s-executing-arbitrary.html

addinutil.exe

  • By Unknown (Documented by @McKinleyMike and @TheLatteri)
  • Insecure Deserialization in AddinUtil.exe
    • https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html

aspnet_compiler.exe

  • By cpl (@cpl3h)
  • The Curious Case of Aspnet_Compiler.exe
    • https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/

bginfo.exe

  • By Oddvar Moe (@Oddvarmoe)
  • Bypassing Application Whitelisting with BGInfo
    • https://msitpros.com/?p=3831

cdb.exe

  • By Matt Graeber (@mattifestation)
  • Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
    • http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html

csi.exe

  • By Casey Smith (@subTee)
  • Application Whitelisting Bypass - CSI.EXE C# Scripting
    • https://web.archive.org/web/20161008143428/http://subt0x10.blogspot.com/2016/09/application-whitelisting-bypass-csiexe.html

dbghost.exe

  • By Casey Smith (@subTee)
  • dbghost.exe - Ghost And The Darkness
    • https://web.archive.org/web/20170926164017/http://subt0x10.blogspot.com/2017/09/dbghostexe-ghost-in-darkness.html

dbgsrv.exe

  • By Casey Smith (@subTee), Ross Wolf (@rw_access)
  • How to Bypass WDAC with dbgsrv.exe
    • https://fortynorthsecurity.com/blog/how-to-bypass-wdac-with-dbgsrv-exe/
  • Fantastic Red-Team Attacks and How to Find Them
    • https://i.blackhat.com/USA-19/Thursday/us-19-Smith-Fantastic-Red-Team-Attacks-And-How-To-Find-Them.pdf

dnx.exe

  • By Matt Nelson (@enigma0x3)
  • BYPASSING APPLICATION WHITELISTING BY USING DNX.EXE
    • https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/

dotnet.exe

  • By Jimmy Bayne (@bohops)
  • DotNet Core: A Vector For AWL Bypass & Defense Evasion
    • https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/

fsi.exe

  • By Nick Tyrer (@NickTyrer) [Write-up: Jimmy Bayne (@bohops)]
  • GitHub Gist: fsi.exe inline execution
    • https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1
    • https://twitter.com/NickTyrer/status/904273264385589248
  • Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
    • https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/

fsiAnyCpu.exe

  • By Nick Tyrer (@NickTyrer) via fsi.exe inline execution [Write-up: Jimmy Bayne (@bohops)]
  • GitHub Gist: fsi.exe inline execution
    • https://gist.github.com/NickTyrer/51eb8c774a909634fa69b4d06fc79ae1
    • https://twitter.com/bohops/status/1319096336441090050
  • Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
    • https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/

infdefaultinstall.exe

  • By Kyle Hanslovan (@KyleHanslovan), Chris Bisnett (@chrisbisnett)
  • Evading Autoruns - DerbyCon 7.0
    • https://github.com/huntresslabs/evading-autoruns
  • RE: Evading Autoruns PoCs on Windows 10
    • https://medium.com/@KyleHanslovan/re-evading-autoruns-pocs-on-windows-10-dd810d7e8a3f

InstallUtil.exe

  • By James Forshaw (@tiraniddo)
  • DG on Windows 10 S: Abusing InstallUtil
    • https://www.tiraniddo.dev/2017/08/dg-on-windows-10-s-abusing-installutil.html

IntuneWindowsAgent.exe (Microsoft.Management.Services.IntuneWindowsAgent.exe)

  • By Kim Oppalfens (@TheWMIGuy)
  • Intune Windows Agent Bypass Explanation
    • https://github.com/bohops/UltimateWDACBypassList/issues/1

kill.exe

  • By @hyp3rlinx
  • Microsoft Process Kill Utility "kill.exe" - SEH Buffer Overflow
    • http://hyp3rlinx.altervista.org/advisories/MS-KILL-UTILITY-BUFFER-OVERFLOW.txt
    • https://twitter.com/bohops/status/1324563760967753730

microsoft.Workflow.Compiler.exe

  • By Matt Graeber (@mattifestation)
  • Arbitrary, Unsigned Code Execution Vector in Microsoft.Workflow.Compiler.exe
    • https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb

msbuild.exe

  • By Casey Smith (@subTee)
  • Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
    • https://web.archive.org/web/20160920161634/http://subt0x10.blogspot.com/2016/09/bypassing-application-whitelisting.html

mshta.exe

  • By Unknown (Documented by @conscioushacker)
  • Application Whitelisting Bypass: mshta.exe
    • https://web.archive.org/web/20171118145940/http://blog.conscioushacker.io/index.php/2017/11/17/application-whitelisting-bypass-mshta-exe/

powershellcustomhost.exe

  • By Lasse Trolle Borup (@TrolleBorup)
  • A simple Device Guard bypass
    • https://danishcyberdefence.dk/blog/device-guard-powershellcustomhost

rcsi.exe

  • By Matt Nelson (@enigma0x3)
  • BYPASSING APPLICATION WHITELISTING BY USING RCSI.EXE
    • https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/

runscripthelper.exe

  • By Matt Graeber (@mattifestation)
  • Bypassing Application Whitelisting with runscripthelper.exe
    • https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc

texttransform.exe

  • By Unknown
  • TextTransformer - Tool Use Case [Documented by Casey Smith (@_subTee)]
    • https://github.com/secdev02/TextTransformer
  • TextTransform Shellcode Injection Template [Documented by Chris Sphen (@ConsciousHacker)]
    • https://gist.github.com/ConsciousHacker/40dfd14b9ecefec49803c509712346a9
  • Placeholder reference (coming soon)

visualuiaverifynative.exe

  • By Lee Christensen (@tifkin_) [Write-up: Jimmy Bayne (@bohops)]
  • Exploring the WDAC Microsoft Recommended Block Rules: VisualUiaVerifyNative
    • https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/

wfc.exe

  • Tipped by MSRC and Matt Graeber (@mattifestation) [Write-up: Jimmy Bayne (@bohops)]
  • Exploring the WDAC Microsoft Recommended Block Rules (Part II): Wfc.exe, Fsi.exe, and FsiAnyCpu.exe
  • https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/

windbg.exe

  • By Matt Graeber (@mattifestation)
  • Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner
    • http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html

wmic.exe

  • By Casey Smith (@subTee)
  • WMIC.EXE Whitelisting Bypass - Hacking with Style, Stylesheets
    • https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html

WSL Family - bash.exe, lxrun.exe, wsl.exe, wslconfig.exe, wslhost.exe

  • By Alex Ionescu (@aionescu)
  • Fun with the Windows Subsystem for Linux
    • https://github.com/ionescu007/lxss

On Block List - Not Documented Yet...

  • dbgsvc.exe
  • kd.exe
  • ntkd.exe
  • ntsd.exe
  • HVCIScan.exe

Libraries On List (Independent usage may/may not be interesting)

  • Microsoft.Build.dll
  • Microsoft.Build.Framework.dll
  • msbuild.dll
  • lxssmanager.dll
  • system.management.automation.dll
  • webclnt.dll/davsvc.dll
  • mfc40.dll

Other "Unsigned Code Execution" LOLBINs (not on list)

texttransformcore.exe

  • Placeholder reference (coming soon)

microsoft.xsldebugger.host.exe

  • Placeholder reference (coming soon)

WinDbgX.exe

  • By Cerbersec (@cerbersec)
  • Bypass WDAC WinDbg Preview
    • https://cerbersec.com/2025/04/07/bypass-wdac-windbg-preview.html

PowerShell

UMCI BYPASS USING PSWORKFLOWUTILITY: CVE-2017-0215

  • By Matt Nelson (@enigma0x3)
  • https://enigma0x3.net/2017/10/19/umci-bypass-using-psworkflowutility-cve-2017-0215/

DEFEATING DEVICE GUARD: A LOOK INTO CVE-2017-0007

  • By Matt Nelson (@enigma0x3)
  • https://enigma0x3.net/2017/04/03/defeating-device-guard-a-look-into-cve-2017-0007/

Exploiting PowerShell Code Injection Vulnerabilities to Bypass Constrained Language Mode

  • By Matt Graeber (@mattifestation)
  • http://www.exploit-monday.com/2017/08/exploiting-powershell-code-injection.html

A LOOK AT CVE-2017-8715: BYPASSING CVE-2017-0218 USING POWERSHELL MODULE MANIFESTS

  • By Matt Nelson (@enigma0x3)
  • https://enigma0x3.net/2017/11/06/a-look-at-cve-2017-8715-bypassing-cve-2017-0218-using-powershell-module-manifests/

CVE-2018-8212: DEVICE GUARD/CLM BYPASS USING MSFT_SCRIPTRESOURCE

  • By Matt Nelson (@enigma0x3)
  • https://enigma0x3.net/2018/10/10/cve-2018-8212-device-guard-clm-bypass-using-msft_scriptresource/

Invoke-History Constrained Language Mode Bypass

  • By Matt Graeber (@mattifestation)
  • https://twitter.com/mattifestation/status/1095416185053696000

Novel Living-Of-The-Land/COM/Microsoft Office/Active Scripting Languages (jscript.dll, msxml3.dll, msxml6.dll)

Bypassing Device Guard with .NET Assembly Compilation Methods

  • By Matt Graeber (@mattifestation)
  • http://www.exploit-monday.com/2017/07/bypassing-device-guard-with-dotnet-methods.html

Sneaking Past Device Guard (+ CVE-2018-8417)

  • By Philip Tsukerman (@PhilipTsukerman)
  • https://conference.hitb.org/hitbsecconf2019ams/materials/D2T1%20-%20Sneaking%20Past%20Device%20Guard%20-%20Philip%20Tsukerman.pdf

WLDP CLSID policy .NET COM Instantiation UMCI Bypass

  • By James Forshaw (@tiraniddo)
  • https://bugs.chromium.org/p/project-zero/issues/detail?id=1514&q=

WSH INJECTION: A CASE STUDY

  • By Matt Nelson (@enigma0x3)
  • https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/

Application Whitelisting Bypass and Arbitrary Unsigned Code Execution Technique in winrm.vbs

  • By Matt Graeber (@mattifestation)
  • https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404

COM XSL Transformation: Bypassing Microsoft Application Control Solutions (CVE-2018-8492)

  • By Jimmy Bayne (@bohops)
  • https://bohops.com/2019/01/10/com-xsl-transformation-bypassing-microsoft-application-control-solutions-cve-2018-8492/

Abusing Catalog Hygiene to Bypass Application Whitelisting

  • By Jimmy Bayne (@bohops)
  • https://bohops.com/2019/05/04/abusing-catalog-file-hygiene-to-bypass-application-whitelisting/

BYPASSING DEVICE GUARD UMCI USING CHM – CVE-2017-8625

  • By Oddvar Moe (@Oddvarmoe), Matt Nelson (@enigma0x3)
  • https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/

UMCI VS INTERNET EXPLORER: EXPLORING CVE-2017-8625

  • By Matt Nelson (@enigma0x3)
  • https://enigma0x3.net/2017/08/24/umci-vs-internet-explorer-exploring-cve-2017-8625/

Bypassing WDAC with Previous Versions of Signed Script Hosts & Signature Catalog Files

  • By William Easton (@strawgate)
  • https://github.com/strawgate/Advisories/blob/main/Microsoft/VULN-051861.md

Novel Exploitation/Bring Your Own Vulnerable Application (BYVA)

Bypassing Windows Defender Application Control with Loki C2 (via NodeJS-Electron Apps)

  • By Bobby Cooke (0xBoku)
  • https://www.ibm.com/think/x-force/bypassing-windows-defender-application-control-loki-c2

Operationalizing browser exploits to bypass Windows Defender Application Control (WDAC)

  • By Valentina Palmiotti (@chompie1337)
  • https://www.ibm.com/think/x-force/operationalizing-browser-exploits-to-bypass-wdac

Defense, Policy Creation, Testing, & Research

WDAC Twitch Stream

  • Fantastic videos collection that covers WDAC Policy Creation/Enforcement/Bypass/Audit/Etc.
  • By Matt Graeber (@mattifestation)
  • https://www.youtube.com/playlist?list=PL2Xx-q-W5pKUNaNkakjZkLmfsNvMWPdNB

WDAC Policy Wizard

  • Documentation and tools to access Windows Defender Application Control (WDAC) technology
  • By Microsoft Docs
  • https://github.com/MicrosoftDocs/WDAC-Toolkit

WDACTools

  • A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies
  • By Matt Graeber (@mattifestation)
  • https://github.com/mattifestation/WDACTools

WDACPolicies

  • A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies
  • By Matt Graeber (@mattifestation)
  • https://github.com/mattifestation/WDACPolicies

Building a Windows Defender Application Control Lab

  • By FortyNorth Security (@FortyNorthSec)
  • https://fortynorthsecurity.com/blog/building-a-windows-defender-application-control-lab/

Documenting and Attacking a Windows Defender Application Control Feature the Hard Way — A Case Study in Security Research Methodology

  • By Matt Graeber (@mattifestation)
  • https://posts.specterops.io/documenting-and-attacking-a-windows-defender-application-control-feature-the-hard-way-a-case-73dd1e11be3a

WinAWL

  • Windows Application Control Notes and Sample Policies
  • By Brian in Pittsburgh (@arekfurt)
  • https://github.com/arekfurt/WinAWL

Exploit Monday Blog

  • By Matt Graeber (@mattifestation)
  • http://www.exploit-monday.com/

Quick Steps for Deploying a Policy & Setting Up a WDAC Test Machine

  • By Jimmy Bayne (@bohops)
  • Restrictive Policy: https://gist.github.com/bohops/bd763d87187b79c0c749da6be7be8a42
  • Scan Policy: https://gist.github.com/bohops/148375490c5ead713ed8a433b466182f

Windows Defender Application Control (WDAC) Updates in 20H2 and Building a Simple, Secure Windows-only Policy

  • By Matt Graeber (@mattifestation)
  • https://mattifestation.medium.com/windows-defender-application-control-wdac-updates-in-20h2-and-building-a-simple-secure-4fd4ee86de4

Harden Windows Security: WDAC Notes

  • By HotCakeX (@HotCakeX)
  • https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-Notes

WDAC Notes

  • By Chad Duffey (@duff22b)
  • https://www.chadduffey.com/wdac/2021/01/26/WDAC-notes.html
Télécharger l’outil