3 ms·

The (base64-encoded) binary can even be stored directly in the Registry: https://twitter.com/tenrobots/status/1552179803121258496 https://twitter.com/tenrobots/

• jgalentine007 4y ago
  Yes, there is an atomic test / mitre attack technique exactly for this. The lame part is the attack executes successfully on stock windows 10/11. Its one of the top threats of 2021/2022. https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-11---powershell-fileless-script-execution https://github.com/redcanaryco/atomic-red-team/blob/master/a...