Sneaking Past Device Guard
Explore the intricacies of bypassing Device Guard in this 45-minute conference talk from WEareTROOPERS. Delve into the concept of Device Guard, its practical applications, and the implications of arbitrary code execution. Examine lateral movement techniques, the role of Office in protected models, and trusted locations. Learn about PowerShell in Constrained Language Mode and its potential for arbitrary code execution. Discover the benefits of Excel macros and ActiveScript bypasses, including common hosts and engines. Investigate Device Guard in ActiveScript, XSLT transforms, and various implementation differences. Analyze patching limitations and combine multiple techniques for effective bypasses. Gain insights into detection tools and potential future developments in Device Guard. Conclude with recommendations for further learning and experts to follow in the field.