In this special episode of War Stories, Zac sits down with one of his heroes, Matt Graeber! Matt is the Director of Threat Research at Red Canary. Matt is known for his expertise in threat research and offensive security. He has made significant contributions to the offensive security field through his work on a variety of topics including PowerShell security, Windows endpoint security, detection engineering strategies and much more. His research has been influential in advancing the understanding of modern cyber threats and improving defensive strategies against them.
Zac and Matt cover a variety of technical topics including the origins of Invoke-Shellcode, Matt's favorite LOLBINS, his research in code signing and other esoteric Windows security topics. Matt shares his more powerful tool, the research methodology inspired by the work of James Forshaw, and they end the show with a story of Matt falling through a ceiling! Don’t miss this one!
Episode Summary
In this special episode of War Stories, host Zac Davis sits down with Matt Graeber, Director of Threat Research at Red Canary and the researcher behind Invoke-Shellcode, a PowerShell tool that changed how a generation of penetration testers got their first shell. They talk about his unusual start in security, the failure that led to Invoke-Shellcode, and his research into hiding payloads in signed files.
Matt spent six years on active duty in the Navy as a Chinese linguist, and traces his interest in security back to overnight guard duty at a small facility, watching who came and went. With an associate degree in computer science and a lifelong habit of taking computers apart, he moved into offensive security. For many testers who started around 2013, Invoke-Shellcode was a game changer: one short PowerShell download cradle could pull down a script and run a reverse shell entirely in memory, leaving nothing on disk for antivirus to catch.
The story behind the tool starts with a payload that did not work. An earlier approach that converted a hex string into bytes and executed it was caught by antivirus, and within minutes security staff were knocking on the door. It was not his proudest moment, but it forced him to rethink how code could run in memory, and that led to Invoke-Shellcode. Matt also talks about later research into embedding HTA payloads inside signed file formats like CAB and WIM files without invalidating the signature.
In This Episode
- Matt Graeber's path from Navy Chinese linguist to offensive security researcher
- The origin story of Invoke-Shellcode and in-memory PowerShell payloads
- PowerShell download cradles and why they changed penetration testing
- Getting caught by antivirus and what that failure taught him
- Embedding HTA payloads in signed file formats without breaking signatures
Would Your Defenses Catch In-Memory Attacks?
Fileless and in-memory techniques are still central to real-world attacks. SEVN-X runs red team engagements, purple team exercises, and penetration tests that test whether your detection and response can keep up. Talk with our team about scoping a test for your organization.
