Bypassing Application Whitelisting with runscripthelper.exe

Introduction

While running through one of the labs for our PowerShell course, I stumbled upon a Microsoft-signed PowerShell host process in System32 — runscripthelper.exe. This program was just…

Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript

Adventures in Extremely Strict Device Guard Policy Configuration Part 1 — Device Drivers

A Look at CVE-2017–8715: Bypassing CVE-2017–0218 using PowerShell Module Manifests

The PowerView PowerUsage Series #4

This is a short follow-up to my “A Guide to Attacking Domain Trusts” post, and the fourth post in my “PowerView PowerUsage” series. It follows the same Scenario/Solution/Explanation pattern as the previous entries, with the original post containing a constantly updated…

Raphael’s Thoughts: SpecterOps acquires MINIS

Today, SpecterOps announces its acquisition of MINIS LLC. The company is doing its social media thing to spread the word. I wanted to take a moment to share the news and comment on it in my own words. If you want press release language, we have that…