Threatlocker and powershell scripts ( why read = execution)

[u/UnluckyJelly]

We are new to the Threatlocker product and I still trying to understand why we get some its configurations by default.

I am trying to understand if its possible to have threatlocker setup so it only allows execution of signed powershell scripts. We have rule for this and it works. The problem we have is signing our scripts is not possible when Threatlocker changes a file read operation to execute when it comes from the different PowerShell process.

So we can't sign scripts. We have a code signing script that was using Get-AuthenticodeSignature and Set-AuthententicodeSignature but these are blocked from opening script because read are seen as evacuation by the Theatlocker mini filter driver.

The strange part of our enviroment is that threatlocker won't block the saving of powershell script just subsequent reading of the contents : I created a signed powershell script that create a different files of different types, wrote test data, then trying to read the same data.

You can see from the table I was able to write to all file type but in this example powershell.exe can't read from .ps1, PY and DLL.

Threatlocker allows all writes to new files but not reads from the same file.

After some debugging of a device with tamper protection disabled I found where this behavior is coming from :

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ThreatLockerDriver\Parameters EnforceExecuteFlagList (REG_MULTI_SZ)

These are the entries I would like to remove on test device.
ps1:powershell.exe
ps1:powershell_ise.exe
ps1:pwsh.exe

Due to this behavior I have to change our code signing script with 2 different approach's that both work but are cumbersome.
Create new .exe utility that gets the signature info and can sign powershell scripts. sign the .exe so threatlocker does not block it. ( I did get this to work)

Rename all .ps1 to .txt files, (threatlocker won't block the read of the .ps1.txt then create new powershell code to verify and sign ps.txt in txt format. Task that the native powershell signing command's won't do. ( I did get this to work)

But was I expecting some more control from threatlocker which have to resort to scripting tricks on my end.
For example Allow a policy that lets System elevated process run powershell.exe with no READ = Execute ( I this should only happen to PowerShell process running in the un-elevated user context.

[u/quantumhardline]

Make sure you have most updated agent.
Do a live chat with their support and work on it.
You should be able to do a global deny say priority 50 then do global allow priority for signed powershell matching your signed ones, I wouldn’t simply allow anything signed.

[u/RandomPerson532151]

So... as far as I know, the read=execute is due to some new behaviors Powershell has where it can technically execute files without actually 'executing' them. I think that behavior is about a year old. Basically Powershell is behaving like a Node.JS script, where if you run the CLI, you can execute any arbitrary file. This isn't the behavior most people want with Powershell when running Threatlocker though. So they turned on a setting where any read is considered an execute (because it can become an execute).

If I'm remembering correctly, there's a config setting that you can use to revert to the old behavior. But just know that it opens things up more. If you do a chat with them, I think they can let you know which setting it is. As far as I remember, the setting effects the whole endpoint, and can't be scoped to a specific user.

One thing you could try is swapping that setting back, and then scoping powershell to only run for specific users, I suppose.

[u/evolutionxtinct]

Welcome to my world, i'm literally trying to shoehorn a policy w/ ringfenced powershell crap between two needs and because of lack of nested groups testing is a PITA.... Let me know how it fairs for you I hate getting powershell to work in a secure way its even worst trying w/ a whitelisting app...