Living off the land on Windows

Attack techniques that run code through Windows' own signed binaries and scripting hosts, such as msiexec, rundll32 and the Windows Script Host, instead of dropping obvious tooling.