Application control absent, allowing arbitrary executables to run
- Affected asset
- Standard operating environment, staff workstations
- Rating
- High Likely 4 × High 4 = 16
Description
Application control is not enforced on staff workstations. A standard user can download and run an arbitrary executable from their profile directory, which means the first mitigation strategy, and the one that stops most commodity malware, provides no protection. This holds the environment below Maturity Level One for this strategy.
Evidence
C:\> whoami
corp\a.nguyen # standard user, not admin
C:\> copy \\test\share\notmalware.exe %TEMP%\
C:\> %TEMP%\notmalware.exe
[+] Executed from user-writable path; no policy blocked it
A standard user ran an unapproved executable from a writable directory with nothing to stop it.
Impact
Most commodity malware and initial-access tooling runs exactly this way, as an executable from a user-writable path. Without application control, a single phishing click can run whatever it downloads. Application control is the strategy ASD lists first because it closes this door, and here it is open.
Remediation
Implement application control in audit mode first to understand what runs legitimately, then move to enforcement, allowing only approved executables, scripts and installers from trusted locations. Windows Defender Application Control is available on every supported edition of Windows, and AppLocker on the Enterprise and Education editions, so this rarely needs new licensing.