As organizations are embracing the new whitelisting model, it becomes imperative to understand what applications you trust. Solutions such as AppLocker, and DeviceGuard go a long way to provide increased defense. However, attackers can leverage existing, default, signed tools to execute arbitrary code. This talk will describe multiple utilities that have been discovered to execute code in unexpected ways. The methods we use do not rely on exploitation at all. In fact they follow recommended patterns for developers. The purpose of this talk is to inform defenders, as well as provide insight into uncovering these patterns at scale.