How Nested Execution Can Abuse a Trusted Windows Application

Summary

A walkthrough shows how Windows Server Essentials’ signed WseClientSvc.exe can load a .NET pass-through program that launches another executable, potentially making arbitrary execution appear to use a legitimate service.

Key points

• The author found multiple unfamiliar services sharing the same executable while reviewing a suspicious item on a partner’s host.
• WseClientSvc.exe, a signed Microsoft binary included with Windows Server Essentials Connector for Windows Server 2012 R2, attempts to load a file passed as an argument.
• Directly passing calc.exe failed because the application expected a .NET assembly.
• A simple .NET pass-through program allowed WseClientSvc.exe to launch calc.exe when invoked with both programs as arguments.
• The article suggests the Windows Server 2012 Essentials SDK’s service-hosting components could be used to create a pass-through service that calls arbitrary executables.

Vendors

Products

Related Articles

• Hexastrike Details S5PIVOT Proxy in Qilin Ransomware Intrusionhexastrike.comMicrosoft
• Proofpoint Details BluePhishing Consent Abuse Against Microsoft Entra Agent Identitiesproofpoint.comMicrosoft
• Microsoft Reports Storm-3358 Using ARTEX to Target Financial Organizationsmicrosoft.comMicrosoft
• CIS Details Device Code Phishing’s Growth and Impact on U.S. SLTTscisecurity.orgMicrosoft
• Security Roundup: Flowise Exploitation, AI Credential Theft and SAP Riskssecurityweek.comMicrosoft