Sneaking Past Device Guard
summary
Claims a set of practical WDAC/Device Guard bypasses that let unsigned code run without toggling the feature, with some techniques needing admin and others working as low-privilege using only native executables. Demonstrations include VBA via COM injection and trusted locations to run macros filelessly, Excel 4 macros that register DLL exports to execute shellcode, an IsClassAllowed omission in Active Scripting hosts and engines that creates COM objects unchecked, and reuse of signed vulnerable DLLs (patched upstream but still usable) to achieve arbitrary code execution.
AI-written summary · about
chapters (8)
- 0:00Introduction to Device Guard
- 7:53Bypassing Device Guard with VBA
- 15:49Excel 4.0 Macros Exploit
- 20:24Active Script Engine Bypasses
- 31:50Scripting Host Vulnerability
- 36:53Patch Limitations and Catalog Hygiene
- 40:14Detection and Prevention Methods
- 42:18Future of Application Whitelisting
related talks
48m"Sneaking Past Device Guard"
51mSneaking Past Device Guard
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
39mDefender-Pretender: When Windows Defender Updates Become a Security Risk
39mWindows Agentless C2: (Ab)using the MDM Client Stack
50mWrite Once, Pwn Anywhere