is that detection of abusing when the service do a unsafe dll load of a not existing file from all path entries?
-
This Tweet is unavailable.
-
although this privesc bug was fixed (denied std priv user), an entry like below can be created by a local admin to persist a program (every time usosvc starts) https://github.com/irsl/CVE-2020-1313 …pic.twitter.com/xLVaDJDxmz
Oh- allright , it also attempts to load a not existing dll from path , we used that in the .net core priv esc
