ServiceUI Trick

Key Takeaways

Say we want to gain an interactive system shell. Now, we've covered this in a couple other videos. Normally noting, okay, you could do this via the taskuler or scheduled tasks on Windows. And Richard Davey walks through this operation where you can do this via the graphical user interface, just setting up a new task and then having it run service UI with whatever you want and then it'll execute as system. and he showcases this query user technique as you would to be able to find a specific loon session but that would get you where you want to go. So on its own service UI.exe still can act as like a sort of execution cradle and I think that's a point worth mentioning here it is service UI.exe exe and that is a super teeny weeny small and tiny trit trivial thing where it could potentially break some detections detection rules hunting for execution of malicious binary out of the blue well now if it's coming from trusted legitimate real Microsoft signed binary that is not something you have rules for eh just one thing staging that could still mean a really simple proxy execution context so that you don't have a child process out of Explorer.exe or wherever, whatever.