Emeric Nasi provided his talk Breach the Gates: Initial Access Craft in 2024, given at OffensiveX in Athens in June, on recent trends and a few tricks for Initial Access.
The slides are available on GitHub.
They range from gaps in the Office macro policy, HTA and WSF polyglots and obfuscated LNK files to fake PDFs and malicious MSC files.
The MSC section builds on Genians’ report on Kimsuky sending a Management Console file disguised as a Word document to its targets.
Elastic’s GrimResource research then showed a crafted MSC file running code in mmc.exe as soon as it is opened, no click on a task needed.
