4 ms·

Neat, but replacing Utilman.exe with cmd.exe using most Linux ISOs is easy, and I've already got the drives needed. The amount of customers that get locked out

• shawnz 3y ago
  They actually recently made this attack vector more difficult with a recent Windows Defender update: https://security.stackexchange.com/a/176456 https://security.stackexchange.com/a/176456
  • jesprenj 3y ago
    A trick I used that still worked after this Defender update (tested some months ago) is replacing Magnify.exe with ftp.exe. This does not make Defender suspicipus, but one can open Magnify.exe from the lock screen and one can execute commands from within the ftp.exe shell by prefixing them with !. This is great, because ftp.exe binary is signed by Microsoft and is a completely legit binary (: