"We were able to load an arbitrary Proxy DLL (which loaded another arbitrary DLL) and execute our code within a service's process which is signed by Symantec Corporation as NT AUTHORITYSYSTEM, resulting in bypassing the self-defense mechanism of the program," SafeBreach explains.