DFSP # 409 - Regsvcs and Regasm Abuse

Published: Dec. 19, 2023, 5:03 a.m.

This week I\u2019m talking about Regsvcs /Regasm exploitation, which is a Windows tactic attackers use to evade defense mechanisms and execute code. Specifically, this technique can be used to bypass process whitelisting and digital certificate validation. I'll break down some interpretation methods that may be used to identify such exploitation....