Loading story…
Researchers reported that Windows Provisioning Package files (.ppkg) can be weaponized to execute arbitrary commands while appearing to be legitimate deployment artifacts used for device setup and configuration. The packages, typically created with Windows Configuration Designer in the Windows ADK, can contain scripts, installers, account settings, network configuration, and other customization data; the research also noted that sensitive values, including commands and credentials, may be stored in clear text in customizations.xml.
The demonstrated attack requires elevated privileges and user interaction, including a User Account Control prompt and a second confirmation step, making social engineering or prior access important to successful abuse. Defenders were advised to monitor the Microsoft-Windows-Provisioning-Diagnostics-Provider log, particularly Event IDs 10 and 20, along with Windows auditing events 4657 and 4663, and to review forensic artifacts in C:\ProgramData\Microsoft\Provisioning and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\Results; the runtime process provtool.exe was identified as central to package execution and investigation.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
A post on r/netsec referenced the topic "Code Execution via Provisioning Packages" and linked to the external ipurple.team item. The visible post snippet did not add substantive technical details beyond pointing readers to the research.
Purple Team published research describing how Windows Provisioning Package (.ppkg) files can be abused to execute arbitrary commands, including via social engineering or by planting malicious packages for later execution. The write-up also documented detection and forensic opportunities such as Provisioning Diagnostics Provider events, provisioning file paths, registry artifacts, and provtool.exe activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Security researchers disclosed **"Plug And Pwn,"** a technique that abuses Windows 11 Plug and Play auto-install behavior to gain `NT AUTHORITY\SYSTEM` code execution on fully updated systems without a kernel zero-day. By presenting a crafted or emulated USB device, the attack causes Windows to fetch signed vendor driver packages and run privileged installation components before user logon. The demonstrated chains relied on weaknesses in third-party software tied to devices from **Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros**, including DNS manipulation, plaintext HTTP configuration retrieval, path traversal, arbitrary file write, privileged registry abuse, and DLL search-order hijacking or sideloading.
Aug 18, 2026
Blackpoint Cyber reported an intrusion at an industrial organization in which attackers deployed **PCHunter64.exe** from the unusual path `C:\PerfLogs`, alongside **AnyDesk**, **FileZilla**, **MASSCAN**, and **RDP** activity across seven endpoints. Investigators observed failed `ADMIN$` share mount attempts by two user accounts on one machine, indicating attempted lateral movement, and Blackpoint said it isolated affected systems within minutes before issuing remediation guidance. The incident underscores continued abuse of legitimate or allowlisted Windows administration and remote-access tools in operational environments. Sandbox analysis of **PCHunter64** shows the tool can go well beyond administration, including dropping signed driver components, creating Windows service registry entries such as `PCHUNTER64`, loading kernel drivers, deleting **SafeBoot** registry keys, and exhibiting anti-debugging and anti-VM behavior. The activity aligns with MITRE ATT&CK persistence techniques including **Windows Service** creation or modification (`T1543.003`) and boot or logon autostart execution (`T1547.008`), while additional indicators pointed to credential-access behavior, including an artifact consistent with **LSASS** minidump collection. Together, the references show how a dual-use utility can be weaponized for persistence, defense evasion, and deeper compromise inside Windows environments.
Jul 19, 2026