Live Patching Windows API Calls Using PowerShell, (Wed, Nov 25th)
SANS Internet Storm Center, InfoCON: green 2020-11-25
Summary:
It&#;x26;#;39;s amazing how attackers can be imaginative when it comes to protecting themselves and preventing security controls to do their job. Here is an example of a malicious PowerShell script that patches live a DLL function to change the way it works (read: "to make it NOT work"). This is not a new technique but it has been a while that I did not find it so, it deserves a quick review.