Sneaking Past Device Guard

on YouTube ↗51m

" summary

Shows concrete Device Guard bypasses that actually run unsigned code: a trusted-location registry write that makes Office run macros with no user action, an Excel 4.0 REGISTER/Call shellcode path that allocates memory and CreateThread to run x86/x64 payloads, Active Scripting hosts (ActiveScriptConsumer, MSXML/XSL) that are not instrumented, and an engine/host mix where mix jscript9 with cscript to skip isClassAllowed so no whitelist check runs. Some methods need admin, one uses only native signed binaries, Microsoft patches few fixes and leaves catalog hygiene problems. Watch if you need reproducible, post‑exploit bypasses and detection ideas.

AI-written summary · about

" chapters (9)

1. 0:00Introduction and motivation
2. 7:54What is Device Guard
3. 16:23VBA macro bypasses
4. 21:47Excel 4.0 macro bypasses
5. 22:30Active Script bypasses
6. 39:51Catalog hygiene issue
7. 44:33Other benefits of techniques
8. 47:51Detection and recommendations
9. 50:03Conclusion and Q&A

" related talks

• 48m"Sneaking Past Device Guard"Philip Tsukerman · CONFidence 2019
• 43mSneaking Past Device GuardP. Tsukerman · Hack In Paris 2019
• 37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed VulnerabilitySergey Chubarov · Black Hat Europe 2022
• 50mWrite Once, Pwn AnywhereYang Yu · Black Hat USA 2014
• 51mOffice in WonderlandPieter Ceelen, Stan Hegt · Black Hat Asia 2019
• 40mBeyond Living-Off-the-Land: Why XP Exploits Still MatterJean-Ian Boutin, Zuzana Hromcova · RSAC 2021
• 58mExploiting Adobe Flash Player In The Era Of Control Flow GuardFrancisco Falcon · Black Hat Europe 2015
• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014