How effective is the LUA script bypass against different AppLocker configurations?
In testing on Windows 7 x86 with default AppLocker rules, the bypass succeeded. However, if an explicit block rule is added for lua.exe (or wlua.exe), the bypass fails. Also, if Lua for Windows is not installed, placing lua5.1.dll and lua.exe in the same directory does not work because AppLocker still blocks the executable. This shows the bypass is narrow and depends on careful rule configuration.
AppLocker bypass effectivenessdefault rulesblock ruletesting