Matt Graeber
More info
- Alias
- mattifestation
- Known for
- PowerSploit, WMI persistence, the AMSI bypass
The researcher who showed how much damage you can do on Windows using only what is already installed.
He started PowerSploit around 2012, a set of PowerShell post-exploitation modules that run entirely in memory. At Black Hat 2015 he showed WMI used as a backdoor with nothing on disk — event subscriptions that launch code, survive reboots and hide where few admins ever looked.
In 2016 he published an AMSI bypass short enough to fit in a tweet, which said something about the robustness of the defence. He later crossed over to the blue side, working on detection and Windows internals telemetry at SpecterOps and Red Canary among others.