Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 992627" data-attributes="member: 32260">There is some misunderstanding about PowerShell and Follina exploit.How PowerShell Constrained Language Mode can stop PowerShell in Follina exploit without spawning PowerSell?The issue is imprecise language.&nbsp;PowerShell is rooted in .NET Framework and most of the PowerShell functionality comes from the System.Management.Automation.dll. We have also EXE files (powershell.exe, powershell_ise.exe, sdiagnhost.exe, etc.) that can import PowerShell functions from this DLL to run PowerShell scripts (CmdLines and script files).The Follina uses a special way to access the PowerShell:msdt.exe --&gt; IScriptedDiagnosticHost COM Object ---&gt; DcomLaunch service --&gt; sdiagnhost.exe ---&gt; runs PowerShell scripts.In this way, the final payload is not a child process of Word. The attackers like such indirect methods to hide their actions and break the parent-child process tree used by AVs to detect threats.</blockquote>

[QUOTE="Andy Ful, post: 992627, member: 32260"] There is some misunderstanding about PowerShell and Follina exploit. [COLOR=rgb(184, 49, 47)][B]How PowerShell Constrained Language Mode can stop PowerShell in Follina exploit without spawning PowerSell?[/B][/COLOR] [B]The issue is imprecise language.[/B] PowerShell is rooted in .NET Framework and most of the PowerShell functionality comes from the System.Management.Automation.dll. We have also EXE files (powershell.exe, powershell_ise.exe, sdiagnhost.exe, etc.) that can import PowerShell functions from this DLL to run PowerShell scripts (CmdLines and script files). The Follina uses a special way to access the PowerShell: [COLOR=rgb(41, 105, 176)][B]msdt.exe --> IScriptedDiagnosticHost COM Object ---> DcomLaunch service --> sdiagnhost.exe ---> runs PowerShell scripts.[/B][/COLOR] In this way, the final payload is not a child process of Word. The attackers like such indirect methods to hide their actions and break the parent-child process tree used by AVs to detect threats. [/QUOTE]

Verification