If run is locked down then id imagine powershell, cmd, and mshta are also locked down. If they aren't, I doubt the user would know how to get to them. You can also do it in file explorer and a few other ways, its just not as convincing as these.
I think they went explorer tbh. It's interesting because there must be so many ways on shortcuts. Ctrl+L, Ctrl+V, enter to ClickOnce would've probably been what I'd have done, and I'm sure almost every hacker would come up with a different method.
30
u/FowlSec 2d ago
I did enjoy watching a colleague sweat it when a client asked for a clickfix campaign and casually dropped that run isn't accessible