One Day Sec

What are the different stagers provided by SILENTTRINITY and how do they work?

SILENTTRINITY includes msbuild, powershell, and wmic stagers, each using a legitimate Windows tool to load the encrypted C# binary into memory. For example, the wmic stager uses an XSL file that decodes and loads the payload when invoked via `wmic os get /format:"evil.xsl"`. These techniques mirror the abuse of trusted utilities seen in Windows Local Privilege Escalation Tool Juicy Potato Testing Analysis.
stagersmsbuildpowershellwmicXSLmemory loading

Browse all Q&A →