Bypassing Application Control

Overview

Bypassing application control is a technique used by adversaries to circumvent security mechanisms that restrict or block the execution of unauthorized software. This technique plays a critical role in the attack lifecycle by enabling attackers to execute malicious code or commands despite enforcement of application whitelisting or control policies. Adversaries use this method to maintain stealth and persistence while evading detection and prevention controls.

Attack Objective

• Gain execution capability despite application control restrictions
• Supports multiple stages including Initial Access, Execution, Persistence, Privilege Escalation, and Defense Evasion
• Advances attacker position by enabling code execution and lateral movement without triggering application control defenses

How the Technique Works

Application control solutions enforce policies that allow only approved applications to run. Adversaries bypass these controls by exploiting trusted processes, abusing signed binaries, leveraging scripting environments, or using other legitimate system tools to execute malicious payloads indirectly. This approach avoids direct execution of blocked binaries and leverages the inherent trust in system components or whitelisted applications.

Common Methods & Variations

• Using living-off-the-land binaries (LOLBins) such as PowerShell, Windows Management Instrumentation (WMI), or certutil to execute code
• Hijacking or abusing signed binaries with elevated privileges (fileless techniques)
• Exploiting script interpreters or macro-enabled documents to launch payloads
• Cloud environments may involve bypassing application control via container escape or abusing cloud-native trusted services
• Identity-based bypasses through delegated permissions or token manipulation

Indicators of Compromise (IOCs)

• Unusual execution of system utilities or scripting engines not typical for the environment
• Unexpected command-line arguments or parent-child process relationships
• Execution of scripts or binaries from non-standard locations or user directories
• Logs showing bypass attempts or policy violations in application control systems
• Network connections originating from processes that typically do not communicate externally

Detection Strategies

• Telemetry from endpoint detection and response (EDR), application control logs, and system audit logs
• Behavioral detection focusing on anomalous process execution, parent-child process chains, and script execution patterns
• Correlation of application control policy violations with other suspicious activities such as privilege escalation or lateral movement

Mitigation & Prevention

• Strict application control policies with minimal exceptions and regular policy reviews
• Whitelisting only necessary binaries and disabling or restricting scripting environments where possible
• Implementing privilege management to limit execution of high-risk tools and scripts
• Regularly updating and patching systems to reduce exploitation of trusted binaries
• Network segmentation and monitoring to limit lateral movement opportunities

Response Considerations

• Immediately isolate affected endpoints to prevent further execution of unauthorized code
• Conduct thorough investigation to identify the scope of bypass attempts and related activities
• Review and tighten application control policies and related security configurations
• Perform system hardening and user education to reduce risk of reoccurrence

Related Techniques

• Execution through trusted binaries (Living off the land)
• Privilege Escalation via abuse of elevated processes
• Defense Evasion through obfuscated or fileless malware
• Lateral Movement by leveraging compromised credentials or remote execution tools

Mapping & References

• MITRE ATT&CK T1548 – Abuse Elevation Control Mechanism
• MITRE ATT&CK T1218 – Signed Binary Proxy Execution
• MITRE ATT&CK T1156 – Execution through API
• Public research on application control bypass techniques from security vendors and incident reports