Post #4490383

Iteration 3: Inject shellcode into winlogon.exe and leak secrets via DNS: https://github.com/persistent-security/month-of-bypasses/blob/main/mob-3-poc-winlogon-clr-injection-dns-exfil.ps1 #mob