More and more entities are deploying Application Whitelisting to prevent malware and detect sophisticated intruders. Is this a viable defense? What are the mechanisms that can be used to evade detection and achieve action on objectives? How can an attacker circumvent this control? These are questions that we will explore in this talk. We have discovered a number of evasion tactics that cannot be patched. These techniques put organizations that deploy Whitelisting at risk. We will focus on techniques used in Windows Environments.