Take Quiz

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1

What is the primary reason Microsoft requires the inetpub directory to exist on Windows 11 systems after the April 2025 Patch Tuesday update?

It serves as a temporary cache folder for Windows Update download files. It is needed to host Internet Information Services (IIS) by default on all Windows 11 systems. It is a remnant folder from deprecated Windows 10 components still kept for backward compatibility. It is required as part of a security fix to patch CVE-2025-21204 involving privilege elevation via symlink attacks.

Question 2

How can malware abuse the Windows Sandbox feature on Windows 10 and 11?

By secretly launching Sandbox instances under different user accounts without showing any UI, allowing persistent malware execution hidden from Windows Defender. By overloading the Sandbox GUI to crash the host system and gain code execution. By installing third-party VM software inside Sandbox to run undetectable malware. By exploiting a kernel bug to elevate privileges and disable the Sandbox isolation completely.

Question 3

What mitigation strategies were suggested to prevent Windows Sandbox abuse by unauthorized users?

Clearing all user scheduled tasks to prevent Sandbox launching via Task Scheduler. Enabling Windows Defender inside Sandbox via PowerShell to allow malware scanning and detection. Uninstalling IIS to remove the inetpub directory, so Sandbox cannot mount shared folders. Disabling virtualization extensions (e.g., Intel VT-x) in BIOS to prevent Sandbox functionality, or using AppLocker to block WindowsSandbox.exe and WSB.exe from running.

Question 4

According to the episode, what is a key limitation of Windows Sandbox related to OS compromise scenarios?

The Sandbox runs a completely isolated guest OS image unaffected by host OS state or kernel hooks. If the host OS is compromised, the Sandbox is inherently compromised because it shares underlying read-only files and memory mappings, including any hooked kernel API functions. Malware inside the Sandbox cannot communicate outside of it, so host compromise doesn't affect Sandbox integrity. Sandbox environments are classified as full virtual machines and therefore cannot be compromised by the host OS.

Question 5

What key issue did Kevin Beaumont discover related to the inetpub directory and the Windows servicing stack patch for CVE-2025-21204?

Renaming the inetpub directory disables Windows Defender, exposing the system to malware attacks. Deleting the inetpub directory causes the Windows servicing stack to corrupt all IIS configuration files permanently. Setting inetpub permissions to allow users full control disables Windows Update scheduling but doesn't affect installation. Creating a junction (symlink) from c:\inetpub to c:\windows\system32\notepad causes Windows Update to fail installing future security patches until fixed.

Cancel

Episode #1023 Quiz

Question 1

Question 2

Question 3

Question 4

Question 5