2025 AppLocker Default Rules Bypass - Using the %WINDIR%\PLA Directory

[pj1234678]

Using a basic script I wrote to discover writable directories by a basic user, I was able to enumerate a directory that was not mentioned
in the UltimateAppLockerByPassList (https://github.com/api0cradle/UltimateAppLockerByPassList)

Here is my script:
@echo off
setlocal enabledelayedexpansion

set "root_path=%windir%"

for /d /r "%root_path%" %%F in (*) do (
set "folder=%%F"
>nul 2>&1 (echo. > "%%F\test_write.txt") && (
echo %%F - Writable
del "%%F\test_write.txt"
)
)

endlocal

It outputted that 3 subfolders that are writable and bypass the default execution rules.
%WINDIR%\PLA\reports*
%WINDIR%\PLA\rules*
%WINDIR%\PLA\Templates*

You can smuggle an EXE in there and launch it regularly.

How to Prevent:

Create 6 Applocker rules to block the following so it covers ADS
%WINDIR%\PLA\reports*
%WINDIR%\PLA\rules*
%WINDIR%\PLA\Templates*
%WINDIR%\PLA\reports:*
%WINDIR%\PLA\rules:*
%WINDIR%\PLA\Templates:*

Date of Discovery: 2/17/25

[dstreefkerk]

In case anyone else, like me, is curious as to what the PLA folder is all about:

The “PLA” subfolder in a Windows installation stands for Performance Logs and Alerts. It’s part of the operating system’s performance monitoring tools, designed to collect performance data from local or remote computers based on predefined schedules. This data is then written to logs or used to trigger alerts. The folder typically contains XML files and subdirectories like Reports, Rules, System, and Templates.

[api0cradle]

I checked this and it is quite interesting. The group that gives this access is the "Performance Log Users". I have currently just checked as standalone VM, but I am in the process of checking this in a default domain environment (I suspect this is not the case in a domain)

[api0cradle]

Just verified, it only happens if you are using a local computer user. In my std AD lab a std user is not a member of that group by default.

[pj1234678]

That tracks with my experiments as well.

I provision computers for Friends and Family, I usually setup a local Admin and restrict them to standard privileges.

I use AppLocker to block most things they shouldn't be using.

Technically this would bypass.

Can we add it to the list of bypasses except have an asterisk for Local user only?