AMSI Bypass × Microsoft Management Console (mmc.exe), apds.dll

The technique exploits an old XSS vulnerability in apds.dll and combines it with DotNetToJScript to achieve code execution, evading static detection.

Crafted MSC file references a vulnerable APDS resource in its StringTable, triggering an XSS flaw in apds.dll to execute arbitrary JavaScript in mmc.exe context. This JavaScript uses DotNetToJScript to run an embedded .NET loader (PASTALOADER) which retrieves payload from environment variables and injects it into dllhost.exe using DirtyCLR, function unhooking, and indirect syscalls.

Monitor for mmc.exe spawning unexpected child processes (e.g., dllhost.exe) with MSC file arguments from non-standard paths. Detect .NET COM object creation with RWX memory allocation in non-standard script interpreters (e.g., mmc.exe) via call stack analysis showing clr.dll called from vbscript.dll or jscript.dll. Block or alert on MSC files with embedded JavaScript or references to apds.dll in StringTable.