Signed, Sealed, Pwned: LOLBin Hollowing in Red Team Operations

The best hiding place is inside a binary that Microsoft signed. This talk presents a complete red team operation built from the tradecraft of a real JScript dropper captured in April 2026 actively targeting Energy, Government, and Aerospace sectors, C2 infrastructure live at time of analysis. We decoded its full five-stage attack chain using custom tooling and operationalized every technique into a repeatable red team playbook. The centerpiece is Process Hollowing into msbuild.exe, a digitally signed Microsoft binary present on every Windows endpoint. We walk through the complete operator workflow: how the dropper delivers a fileless .NET assembly via steganographic C2 on trusted paste services, loads it through Reflection.Assembly::Load() without touching disk, and injects into msbuild.exe using the classic ZwUnmapViewOfSection + VirtualAllocEx + SetThreadContext chain. When your payload runs inside a process Microsoft signed, the OS trust model works against the defender. We cover the full offensive picture: WMI hidden process spawning that breaks parent-child EDR detection chains, the f#→r Base64 substitution trick that defeats automated AV scanners, and how to read Sysmon output as a red team operator understanding exactly what the blue team sees from your operations so you can adjust in real time. Everything demonstrated was extracted from a live adversary sample. Custom Python decoders, JScript and PowerShell emulation scripts, and native Windows capabilities only. The adversary already built the playbook. We just operationalized it.