Abusing Trusted Applications with Nested Execution

Huntress investigators found multiple Windows services invoking the same executable (WseClientSvc.exe). By reversing the binary they discovered it attempts to load a .NET assembly passed as an argument; building a simple passthrough .NET module allowed them to use the signed Microsoft binary to execute arbitrary code (demonstrated with calc.exe), illustrating a living-off-the-land code execution technique.