New attack uses MSC files and Windows XSS flaw to breach networks

Elastic Security researchers uncovered 'GrimResource', a technique that delivers malicious Microsoft Management Console (.msc) files which exploit an unpatched DOM-based XSS in apds.dll to run JavaScript inside mmc.exe, reconstruct a VBScript using DotNetToJScript, load a .NET loader (PASTALOADER), and inject Cobalt Strike into dllhost.exe via DirtyCLR and process injection; a June 6, 2024 sample on VirusTotal shows active exploitation with no AV detections, and the report includes IOCs, YARA rules, and detection recommendations.