Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence (Part 2)

Introduction Two weeks ago, I blogged about several "pass-thru" techniques that leveraged the use of INF files ('.inf') to "fetch and execute" remote script component files ('.sct').  In general, instances of these methods could potentially be abused to bypass application whitelisting (AWL) policies (e.g. Default AppLocker policies), deter host-based security products, and achieve 'hidden' persistence.  … Continue reading Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence (Part 2)

Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence

Introduction Over the last few weeks, I researched and tested a few interesting namespaces/methods documented on various Microsoft/MSDN sources that dealt with executing various COM scripts/scriptlets (e.g. VBscript, Jscript, etc.).  In particular, I was curious to see if there were potentially new ways to invoke remote scripts (ActiveX Objects) by leveraging some of the great … Continue reading Leveraging INF-SCT Fetch & Execute Techniques For Bypass, Evasion, & Persistence

VSTO: The Payload Installer That Probably Defeats Your Application Whitelisting Rules

Introduction Visual Studio Tools for Office (VSTO) "is a set of development tools available in the form of a Visual Studio add-in (project templates) and a runtime that allows Microsoft Office 2003 and later versions of Office applications to host the .NET Framework Common Language Runtime (CLR) to expose their functionality via .NET" (Wikipedia).  For … Continue reading VSTO: The Payload Installer That Probably Defeats Your Application Whitelisting Rules