Yet another environment-based #LOLBIN launcher. DLLs on the screenshot are legit, exe not that much.pic.twitter.com/1G3eaMiLiT
Do I get the goal correctly? To make a signed windows exe launch another arb exe to spoof EDR detect? Cant you do that with any exe running any exe by setting its per process device map ? And make it load any dll
-
-
You can do this multiple way, but I haven't see this one before. For me, it's perfectly enough to tweet about this :)
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.