Thread by @falsneg

Load your DLL payload with a MS-signed executable; deploymentcsphelper.exe, by setting %windir% to C:\dummy and planting your lib as dbghelp.dll under system32 of that dummy folder #lolbin #lolbas

Same with djoin.exe

and dnscacheugc.exe

also ieunatt.exe

https://twitter.com/falsneg/status/1581555086328668160

same with MuiUnattend.exe

and netbtugc.exe

&& netiougc.exe

and BdeHdCfg.exe

and ReAgentc.exe

and setupugc.exe