Bypassing Cylance: Part 1 – Using VSAgent.exe

Black Hills Infosec tested a production Cylance deployment and demonstrated that their custom C2 client, VSAgent.exe, which hides commands in an ASP.NET ViewState parameter, executed and established command-and-control undetected in that environment. The post highlights that weak or missing application whitelisting and unrestricted access to cmd.exe and PowerShell ISE allowed the C2 to function, and recommends stronger application whitelisting and web content controls as mitigations.