The Ghost of Internet Explorer in Windows
Explores how legacy Internet Explorer components and MSHTML COM objects embedded in Windows continue to be weaponized for initial access and N-day exploitation.
Summary
Legacy MSHTML Components in Modern Windows
Although Microsoft officially retired Internet Explorer, underlying legacy rendering engines (MSHTML / Trident) and associated COM interfaces remain deeply embedded within Windows for backward compatibility.
Weaponizing Internet Shortcuts and COM Objects
George Hughey and Rohit Mothe demonstrate how attackers craft malicious .URL and .LNK internet shortcut files that force modern Windows systems to render untrusted web content using deprecated, unpatched IE components.
Bypassing Mark-of-the-Web and Security Controls
Exploiting legacy URL protocol handlers bypasses Windows Mark-of-the-Web (MOTW) protections and application reputation filters, delivering zero-click and one-click remote code execution.
Remediation and Component Disablement
Defending enterprise environments requires disabling legacy IE protocol handlers via Group Policy, blocking unneeded COM class instantiation, and enforcing strict Windows Defender Application Control (WDAC).
Related talks
Main Stage·42 min
Jason Lang
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.