No-Code Malware: Windows 11 at Your Service via Power Automate
Michael Bargury weaponizes Windows 11's built-in Power Automate for desktop, creating zero-binary, signatureless 'no-code malware' that bypasses EDR controls.
Summary
The Pre-Installed Power Automate Engine in Windows 11
Windows 11 includes Power Automate for desktop out of the box, allowing users to automate desktop actions, keypresses, file transfers, and web requests.
Constructing Living-Off-The-Land No-Code Malware
Michael Bargury demonstrates building weaponized automation flows that perform credential harvesting, screen recording, and command execution using native signed Microsoft binaries.
Bypassing Modern EDR and Application Whitelisting
Because Power Automate executes flows via legitimate, trusted system processes, traditional EDR heuristics fail to detect malicious activity.
Enterprise Policy Controls and Flow Auditing
The presentation provides enterprise security administrators with group policy configurations to restrict Power Automate runtime and audit desktop flows.
Related talks
Main Stage·39 min
Helvio Carvalho Junior
HookChain technique for dynamically altering API call sequences and hooking mechanics to bypass EDR telemetry in memory.
Main Stage·27 min
Asaf Gilboa · Ron Ben-Yitzhak
Asaf Gilboa and Ron Ben-Yitzhak present a stealthy credential dumping technique that abuses native Windows Error Reporting (WER) to dump LSASS without alerts.
Main Stage·26 min
Tarek Abdelmotaleb · Bramwell Brizendine
Tarek Abdelmotaleb and Dr. Bramwell Brizendine demonstrate weaponizing Windows syscalls into pure position-independent shellcode, evading modern EDR hooks.