Cannot reproduce and documented not blocking .sct
So I tried to reproduce... and failed for a part. (reproduced on win2012r2)
The problem with your examples is that you already may start calc.exe. You have the rights. Same goes for cmd.exe. You already have the right to start it, so executing your scripts results in applocker not blocking cmd.exe. If you block it, you get a script error on calc.exe
When I deny all users in my testenvironment to start calc.exe, I get a script error in backdoor.srt and in the last excel macro. I cannot start calc.exe. Even as administrator (I denied everyone rights to calc.exe) I cannot start it with applocker on.
So, the only problem you have found is that you can run scripts by this backdoor. Applocker shouldn't allow that. But it partly documented. As documented Applocker will only block scripts with the extensions .ps1, .bat, .cmd, .js and .vbs. It does not block .sct.
Biting the hand that feeds IT
