Blog Data Security

Master Fileless Malware Penetration Testing!

Our five-part series brings you up to speed on stealthy techniques used by hackers. Learn how to sneakily run scripts with mshta, rundll32, and regsrvr32, scary Windows binaries that live...
Michael Buckbee
1 min read
Last updated January 17, 2023

Contents

    This article is part of the series "Living off the Land With Microsoft". Check out the rest:

    Our five-part series brings you up to speed on stealthy techniques used by hackers. Learn how to sneakily run scripts with mshta, rundll32, and regsrvr32, scary Windows binaries that live in your System32 folder!

    What should I do now?

    Below are three ways you can continue your journey to reduce data risk at your company:

    1

    Schedule a demo with us to see Varonis in action. We'll personalize the session to your org's data security needs and answer any questions.

    2

    See a sample of our Data Risk Assessment and learn the risks that could be lingering in your environment. Varonis' DRA is completely free and offers a clear path to automated remediation.

    3

    Follow us on LinkedIn, YouTube, and X (Twitter) for bite-sized insights on all things data security, including DSPM, threat detection, AI security, and more.

    Michael Buckbee
    Michael Buckbee Michael has worked as a sysadmin and software developer for Silicon Valley startups, the US Navy, and everything in between.

    Try Varonis free.

    Get a detailed data risk report based on your company’s data.
    Deploys in minutes.
    Get started View sample

    Keep reading

    Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

    the-malware-hiding-in-your-windows-system32-folder:-more-rundll32-and-lol-security-defense-tips
    The Malware Hiding in Your Windows System32 Folder: More Rundll32 and LoL Security Defense Tips
    the-malware-hiding-in-your-windows-system32-folder:-more-rundll32-and-lol-security-defense-tips
    Michael Buckbee
    July 19, 2018
    When we left off last, I showed how it’s possible to run VBScript directly from mshta. I can play a similar trick with another LoL-ware binary, our old friend rundll32....
    koadic:-pen-testing,-pivoting,-&-javascripting,-part-ii
    Koadic: Pen Testing, Pivoting, & JavaScripting, Part II
    koadic:-pen-testing,-pivoting,-&-javascripting,-part-ii
    Michael Buckbee
    March 29, 2020
    Mshta and rundll32, the Windows binaries that Koadic leverages, have been long known to hackers. If you take a peek at Mitre’s ATT&CK database, you’ll see that rundll32 has been...
    koadic:-lol-malware-meets-python-based-command-and-control-(c2)-server,-part-i
    Koadic: LoL Malware Meets Python-Based Command and Control (C2) Server, Part I
    koadic:-lol-malware-meets-python-based-command-and-control-(c2)-server,-part-i
    Michael Buckbee
    June 17, 2020
    In my epic series on Windows binaries that have dual uses– talkin’ to you rundll32 and mshta — I showed how hackers can stealthy download and launch remote script-based malware....
    the-malware-hiding-in-your-windows-system32-folder:-certutil-and-alternate-data-streams
    The Malware Hiding in Your Windows System32 Folder: Certutil and Alternate Data Streams
    the-malware-hiding-in-your-windows-system32-folder:-certutil-and-alternate-data-streams
    Michael Buckbee
    June 14, 2018
    We don’t like to think that the core Window binaries on our servers are disguised malware, but it’s not such a strange idea. OS tools such as regsrv32 and mshta...