Matt Graeber

Code Signing Certificate Cloning Attacks and Defenses

Adventures in Extremely Strict Device Guard Policy Configuration Part 1 — Device Drivers

Bypassing Application Whitelisting with runscripthelper.exe

Introduction

While running through one of the labs for our PowerShell course, I stumbled upon a Microsoft-signed PowerShell host process in System32 — runscripthelper.exe. This program was just…