Michael Bargury, the co-founder and CTO of Zenity.io, presented “No-Code Malware: Windows 11 At Your Service” at DEFCON 30 which immediately caught the attention of CTIX analysts. Bargury explained a feature included by default in Windows 11 called “Power Automate”, which is robotic process automation (RPA) software that allows users to automate tedious processes. This is done by building custom scripts through Microsoft, which “ensures they are distributed to all user machines or Office Cloud, executed successfully and reports back to the cloud.” In essence, Power Automate can be used to power malware operations. Bargury demonstrated this by registering a victim machine to his own Azure Active Directory tenant. He then showed the process of creating a flow by triggering it from the cloud, setting up a connection to the end-user machine, and distributing a payload. The researcher began demonstrating the power of this method with a simple example, exfiltrating data to the cloud. He did this by using three (3) simple steps: checking if the desired file exists, reading the text from the file, and storing it in the cloud. This is conducted without writing any code and instead uses a block coding system similar to Scratch. In the next example, Bargury demonstrated how code execution is possible through Power Automate. There were some issues presented with this, however, as Windows Defender Antivirus identified the code execution attempt and prevented it. This was due to the script leaving the trusted Power Automate platform to run commands through the untrusted command prompt. With that said, there are many features of Power Automate that could be exploited in the trusted environment. The example Bargury provided is a no-code ransomware that encrypts files with AES using a custom key. While these types of attacks leave traces such as log data on the victim machine, Power Automate can be leveraged by the threat actor to clean up after themselves. Bargury developed a framework dubbed “Power Pwn” which assists red teams in conducting these attacks. Additional details can be found in Michael Bargury’s GitHub and a video of the talk will be posted on YouTube in the coming weeks. CTIX analysts recommend that defenders become familiar with RPA tools such as Power Automate and their potential to be used maliciously in order to better defend against attacks abusing RPA software.