Microsoft Teams|Exe Sideloading aka Exe proxying — Part 1

As a part of threat hunting and research , I have been researching possible ways to evade EDR solutions and basic whitelisting rules to build better defence, The most challenging factor is manual threat hunting without any alerts from tools, This is where we might most like this from our naked eye.

#Microsoft #Teams | Exe Sideloading aka Exe proxying attack technique, Most of the #Nuget/#Squirrel applications affected, No need of installation.

Medium : https://t.co/DinACsSYss
Youtube : https://t.co/xTI8unIlrN

Thanks to @Hexacorn ,@MrUn1k0d3r #blueteam #Redteam #dfir

— Reegun (@reegun21) September 8, 2019