https://unrooted.github.io/tags/lolbas/Recent content in Lolbas on unrooted's blogHugoen-usMon, 20 Jul 2026 00:00:00 +0000https://unrooted.github.io/posts/sandbox-shenanigans-pt1/Mon, 20 Jul 2026 00:00:00 +0000https://unrooted.github.io/posts/sandbox-shenanigans-pt1/<h1 id="sandbox-shenanigans-pt1---the-windows-sandbox-abuse">Sandbox Shenanigans pt.1 - The Windows Sandbox Abuse</h1> <p>Windows Sandbox is a disposable, lightweight VM baked into every Pro/Enterprise install - flip on one optional feature and you get a throwaway Windows box with Defender off by default and optional folder mappings into the host. Genuinely useful for detonating a suspicious attachment. Also, structurally, a gift to anyone trying to hide from your EDR: the payload runs somewhere your host telemetry can&rsquo;t see.</p>