The Wick Blog

Public Service  Announcement This is something I wanted to write a post about as it seems to still be getting lots of hits and fooling lots of people. I will wright the TLDR here so you can get the message now and read further if you want to learn more. If ANY program EVER tells you to disable your Anti-Malware solution PROCEED WITH EXTREAM CAUTION.  If you are ever provided with a password protected archive again PROCEED WITH EXTREAM CAUTION. Now that the TLDR is out of the way let me explain. There have been many campaigns that have been involving something in common, using a password protected zip file hosted with a page that contains both the password AND instructions to disable your Anti-Malware solution. The ZIP file then contains infected files usually Redline or alike however if the person follows the instructions as provided they would have disabled their Anti-Malware solution which would now not detect the sample. This is a common tactic used to distribute malware on...

Microsoft has now included Windows PowerShell in every version of Windows 10 and up. PowerShell is a great tool for automation and for easily making Windows scripts, much of a improvement over the Batch language. However for the average user I have some concerns of it being installed and enabled automatically. If PowerShell is such a good tool then why would I want it to be disabled by default you may be asking, well because with all that power comes the ability for it to be abused to infect users with hard to detect malware. If you did not know its very easy to invoke PowerShell scripts through any application and bypass execution policy, you can put the command in a Batch script or built it into an EXE or even execute it using almost any programming language so invoking it is easier than you think especially as its included with all version of Windows so you always know its going to be in there. However just invoking is not the big issue as that would be the same with Batch, the issu...

Shortcuts, personally I never really use them. They link to a program slash file to run it or to make it easier to execute with arguments such as open minimized window. But I decided to give them a relook with the new Powershell program bundled in with all Windows installations and even released for Linux. Shortcuts if you did not know can pass arguments into the program or file it has been linked to. Usually you use this if for example you want to configure a program to launch silently using lets say a -silent flag. Well just add that into the shortcut and it will launch with that argument without having to open a shell. So what about Powershell? Well it has a interesting flag called " -Command ". The command flag allows you to pass a command or potentially even an entire script into the Powershell process that will be started. Interestingly this means an entire script can run in memory without being stored on disk at all, the most insane version of anti-malware avoidance. N...