AppLocker Path Rule Vulnerabilities

Question

AppLocker Path Rule Vulnerabilities

Sharma Nikhil 80

Our security auditor found that our current AppLocker policy allows users to run executables from the C:\Windows\Tasks folder because it's part of a default path rule. Why is allowing standard users write-access to a permitted AppLocker path a major security risk, and how do we tighten that rule

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

Allowing standard users write‑access to any directory that is whitelisted in AppLocker is a direct privilege escalation risk. AppLocker evaluates rules based on path, publisher, or hash. If you have a path rule that permits execution from C:\Windows\Tasks, and that directory is writable by non‑administrators, a user can drop any arbitrary executable there and AppLocker will allow it to run. This effectively bypasses your intended application control policy, because the enforcement engine sees the path as trusted even though the content is user‑supplied. Attackers often exploit exactly this type of misconfiguration to persist malware or run unauthorized tools under the guise of a permitted path.

The remediation is to tighten the rule so that only directories with restricted ACLs are permitted. For example, AppLocker’s default rules include %SystemRoot% and %ProgramFiles% because those paths are protected by NTFS permissions and cannot be modified by standard users. C:\Windows\Tasks is not protected in the same way, and therefore should not be included in any allow rule. You should remove it from the path rule set and ensure that only secure system paths remain. If you need scheduled task executables to run, allow them by publisher or hash rather than by the writable path.

In practice, review your AppLocker configuration under Local Security Policy > Application Control Policies > AppLocker > Executable Rules. Delete or disable the rule that includes C:\Windows\Tasks. Then confirm the NTFS permissions on that folder: by default, Authenticated Users have write access, which is the root of the problem. Once the rule is removed, executables placed there will be blocked unless explicitly whitelisted by a more restrictive rule. This aligns with Microsoft’s best practice guidance that AppLocker path rules must only reference directories where users cannot introduce new binaries.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.