Abusing Windows EFS to steal data using PowerShell
Details
- Using PowerShell scripts to encrypt data on a machine using EFS:
- Key creation
- Certificate generation
- Using PowerShell scripts to save the keys to memory
- Using PowerShell scripts to erase the decryption keys and certificate store in file locations
- Using the compromised certificate to encrypt files and folders