Windows 11 At Your Service
summary
Claim: Windows 11’s built‑in Power Automate RPA can be turned into a persistent C2 and exfiltration channel. It uses Power Automate agents plus an outbound queue (Azure Relay / Service Bus) so payloads and file bytes travel over trusted Microsoft channels, bypassing firewall/EDR detection. A bundled silent registration script enrolls machines (even non‑admin accounts), allows remote job execution, and can run no‑code ransomware built in the drag‑and‑drop actions — and it works on vanilla Windows 11.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:19In the real world
- 3:41Introducing.. Robotic Process Automation (RPA)!
- 15:16Register victim machines
- 18:15Recap
related talks
41mPower Automate C2: Stealth Living-Off-the-Cloud C2 Framework
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
39mWindows Agentless C2: (Ab)using the MDM Client Stack
25mBack To The Future: Old Tricks Invading A New Attack Surface
21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs Automatically
58mRed Team Techniques for Evading, Bypassing & Disabling MS
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech