"Sneaking Past Device Guard"

on YouTube ↗48m

" summary

Claims multiple practical WDAC/Device Guard bypasses: some require admin, several abuse Microsoft Office without user clicks, and one works from low privilege using only signed native binaries. Walkthroughs include adds HKCU trusted location to run macros (VBA/DCOM lateral move), uses Excel 4 macros to register and execute shellcode in-sheet, registers JScript9 engine to CScript to bypass isClassAllowed checks, and uses MSXML XSLT or ActiveScriptEventConsumer via WMI to run scripts. One technique is patched (CVE-2018-8417); catalog hygiene keeps older signed vulnerable binaries usable. Detection focuses on command-line, WMI and registry activity.

AI-written summary · about

" chapters (8)

1. 0:00Introduction to Device Guard
2. 7:55VBA-based Bypasses
3. 16:21Non-VBA Macro Bypasses
4. 21:49Active Script Bypass Techniques
5. 39:52Catalog Hygiene Issues
6. 43:05Alternative Execution Benefits
7. 45:11Detection and Defense Strategies
8. 46:40Future of Device Guard

" related talks

• 43mSneaking Past Device GuardP. Tsukerman · Hack In Paris 2019
• 51mSneaking Past Device GuardPhilip Tsukerman · HITBSecConf 2019 Amsterdam
• 37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed VulnerabilitySergey Chubarov · Black Hat Europe 2022
• 51mOffice in WonderlandPieter Ceelen, Stan Hegt · Black Hat Asia 2019
• 39mWindows Agentless C2: (Ab)using the MDM Client StackZach Wasserman, Marcos Oviedo · Black Hat USA 2023
• 47mToolShell, Patch Bypass, and the AI That Might Have Seen It ComingPedram Hayati, Soroush Dalili · NDC Manchester 2025
• 40mBeyond Living-Off-the-Land: Why XP Exploits Still MatterJean-Ian Boutin, Zuzana Hromcova · RSAC 2021
• 25mCommSec D1 - A Deep Dive Into Malicious DocumentsJosh Stroschein · Hack In The Box Amsterdam 2018