AppSecurityLimits
IDEA:
Define security-related limits for an executable and embed them into the application, EDR/AV products are responsible for retrieving the data at execution time and limit the application behavior based on the limits.
The tool aims to limit exploit capabilities.
whoami: @_qaz_qaz
Implementation
Developer's role:
Run AppSecurityLimits.exe with an executable path and location of the JSON file.
The tool creates .appsec section in the executable and inserts the JSON config file into the section.
EDR/AV's role:
If an executable contains .appsec section and a magic string is .appseclimits_ then extract a JSON content from the section and control the application behavior accordingly.
For Example, if a JSON content contains following field:
{ ... "remote_process_access" : false, ... }
then an EDR/AV product should deny calls like WriteRemoteProcess since it's not intended to be used according to the application developer.
Third-party
- LIEF (Apache License 2.0)
- nlohmann/json (MIT License)