├── README.md
└── Zeta.cs


/README.md:
--------------------------------------------------------------------------------
 1 | # Zeta
 2 | Using "svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc" as trigger, this "trigger" happens when computer is locked.
 3 | 
 4 | ZwWaitForSingleObject just wait for svchost gets CPU time. The embedded reverses shell is C# classes and can be replaced with your own code.
 5 | 
 6 | This works in normal user context, no admin is required. 
 7 | 
 8 | 
 9 | 
10 | 
11 | 


--------------------------------------------------------------------------------