Security researcher Casey Smith was trying to solve a particular problem and came up with a unique solution. He needed a reverse shell on a workstation that was locked down by the Windows AppLocker. Smith’s technique provides yet another way for cybercriminals to make their way into Windows. He found that if he placed the script block inside of the Registration tag and called regsvr32, the code would execute. The code block, which can be either Visual Basic or JavaScript, is placed inside the element. Smith wrote a. PowerShell server to handle execution and return output.”]
Source: https://securityintelligence.com/news/security-researcher-bypasses-windows-applocker/