Dismantling Smart App Control (And SmartScreen) - 4 new initial access techniques with no security warnings or popups - including LNK mark-of-the-web bypass with over 5 years of ITW use Article: POC: #rephijack #lnkstomping

Few notes for readers 1) SAC is for home users, App control for Business is the enterprise ver 2) WDAC cannot be bypassed like this. 3) Using legit certificate to sign malware doesn't end up good for the person acquired the cert. 4) Windows has a lot more than 2 security layers

Thanks for calling out code signing certs. :) Would you mind uploading a compiled copy of rep-check? It just makes it a little more accessible.

done,