Uses remote DCOM activation of Excel.Application on a Windows target to invoke Application.ExecuteExcel4Macro with an XLM expression. The documented EXEC form can start a process in the remote Excel instance; the Excel 4 macro interface can also invoke other supported macro operations. The technique requires Excel on the target, reachable DCOM/RPC, and an account allowed to remotely activate the COM application. It runs in the target Excel process under the invoking account context and does not itself grant privileges or establish persistence.
PowerShell
RESTRICTED_ACCESS_BLUR_MARKER