Research

Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript

A Look at CVE-2017–8715: Bypassing CVE-2017–0218 using PowerShell Module Manifests

UMCI Bypass Using PSWorkFlowUtility: CVE-2017–0215

Lateral Movement using Excel.Application and DCOM

UMCI vs Internet Explorer: Exploring CVE-2017–8625

WSH Injection: A Case Study

At BSides Nashville 2017, Casey Smith (@SubTee) and I gave a talk titled Windows Operating System Archaeology…

Bypassing AMSI via COM Server Hijacking

Microsoft’s Antimalware Scan Interface (AMSI) was introduced in Windows 10 as a standard…

Phishing Against Protected View

Microsoft Office has a security feature called Protected View. This feature opens an Office document…

Bypassing UAC using App Paths

Over the past several months, I’ve taken an interest in Microsoft’s User Account Control (UAC) feature in…

Defeating Device Guard: A look into CVE-2017–0007