3.5 Modern defense and review¶
Post-Exploitation index · Reviewed 2026-10-27
18. Updates and defensive interpretation¶
Sources checked on 2026-10-27. Treat the chapter's execution model as a foundation, not a complete description of every current capability.
| Topic | Current supplement | Learning implication |
|---|---|---|
| Cobalt Strike | Official notes list 4.13 in June 2026, adding Beacon Interpreter, BOF-PE and Payload Store | Traditional object BOFs and fork & run are not the entire extension model |
| Earlier releases | 4.11 added asynchronous BOF execution; 4.12 changed GUI and added REST API | Check installed help, task management and actual configuration |
| PowerShell | Engine hosting need not involve powershell.exe | Investigate runtime and script telemetry, not just process names |
| In-memory execution | Process, module, access, pipe and network activity may remain observable | Disk absence does not prove absence of evidence |
| Credential Guard | VBS isolates selected authentication secrets | Administrator access does not guarantee access to those secrets |
| SMB | Default signing requirements depend on Windows version and edition | Old lab behavior may not match a modern host |
The release page and release notes document the version changes above.
PowerShell security documentation describes Script Block Logging for automation and AMSI integration in supported environments. Configuration and versions determine actual visibility.
Sysmon can record process creation, network connections, module loading, process access, certain remote-thread operations and pipe activity when configured. Not every event is enabled by default, and not every injection technique is represented by one event. A defensive inference from these capabilities is to correlate process relationships, unexpected runtime loading and communications rather than rely on one command name.
Credential Guard protects selected secrets through VBS. Default enablement on applicable Windows 11 22H2+ and Windows Server 2025 systems depends on licensing, hardware, software and existing policy. It does not protect every secret visible on the screen or clipboard.
| Platform | Default SMB signing requirement in Microsoft's current documentation |
|---|---|
| Windows 11 24H2 Enterprise, Pro, Education | Inbound and outbound |
| Windows Server 2025 | Outbound |
| Windows 11 24H2 Home | Neither direction required by default |
Signing and encryption are different properties. Verify effective configuration rather than assuming these defaults apply after policy changes. Microsoft SMB signing
19. Check your understanding¶
1. Why is a downloaded file not immediately on the Client?
It is transferred to Team Server first. Sync Files retrieves a local copy.
2. Why do shell and run differ with identical output?
Shell uses cmd.exe; run launches the executable directly.
3. Why can a BOF fault terminate Beacon?
Traditional inline BOFs share Beacon's process address space.
4. Is spawn a privilege escalation?
Creating another session does not itself elevate privileges.
5. Where is the powershell-import path?
On the operator's Client in the source example.
6. Is the argument to jobkill a Windows PID?
No. It identifies a Beacon job.
7. Why can printscreen disrupt user work?
It changes and clears clipboard content in the described implementation.
8. Does powerpick guarantee no PowerShell logs?
No. Executable choice, engine hosting and logging are separate issues.
9. Can administrators access every process and credential?
No. Token rights, process protection and isolation still apply.
10. What four questions should accompany every command?
Where does it execute? Whose authority does it use? What state changes? Where do results go?