Further reading

If you want to explore some of the topics that were mentioned in this chapter, follow these resources:

API:

• Low-Level Windows API Access From PowerShell: https://www.fuzzysecurity.com/tutorials/24.html

CIM/WMI:

• Use PowerShell to Manipulate Information with CIM: https://devblogs.microsoft.com/scripting/use-powershell-to-manipulate-information-with-cim/

COM hijacking:

• Demystifying Windows Component Object Model (COM): https://www.221bluestreet.com/offensive-security/windows-components-object-model/demystifying-windows-component-object-model-com
• acCOMplice: https://github.com/nccgroup/acCOMplice
• COM Hijacking Techniques, David Tulis (DerbyCon): https://www.youtube.com/watch?v=pH14BvUiTLY
• OleViewDotNet by James Forshaw: https://github.com/tyranid/oleviewdotnet
• COM Class Objects and CLSIDs: https://learn.microsoft.com/en-us/windows/win32/com/com-class-objects-and-clsids
• Hijacking .NET to Defend PowerShell: https...