Sandbox Bypass via Add-MpPreference cmdlet checking the exit code for non-zero and looping, based on a sample found in the wild delivering #NightshadeC2, source code and tool available at the link below.

PoC code/binary: github.com/eSentire/iocs/tree/ma…