Bypassing Crowdstrike Falcon detection, from phishing email to reverse shell

Hello. Nice write-up and finding! Are you aware of what GPOs this can bypass? What is a solution that can block execution from the GPO’s level without bricking excel? I can’t fully test this since I don’t have the proper environment for it, yet it seems to be a bypass …

3 Likes