#detection

RegisterXLL: Testing Excel's XLL Security Boundary

How Excel's RegisterXLL automation method loads native add-in code through a path that did not enforce the MOTW and extension checks observed in the interactive UI.