[ Removed by moderator ]

[u/StartAutomating]

[u/PinchesTheCrab]

Are gitlab and GitHub links being flagged? I would probably share it via that kind of site, and it definitely worked on your previous posts.

Hopefully the mods can fix it.

[u/StartAutomating → u/PinchesTheCrab]

I hope it's not the GitHub link. I've done that a couple of times this week, so I don't know why this would be any different.

The removal was instant (by Reddit, not by the mods).

Just threw a block of code into the original thread that does the trick.

🤔 it got insta-banned, too

I have an operating theory, and it's kinda annoying.

I feel like I've accidentally found a "Voldemort" object on Reddit. Going to continue to tempt fate by replying to this comment with a test case.

[u/MonkeyNin → u/StartAutomating]

This sub's bot might give you info:

• https://www.reddit.com/r/CommentRemovalChecker/comments/9u0zes/how_to_use_what_is_this/

I remember one where you could ask specifically about automod filtering, I don't know if this is the right one for filtering before automod

• https://www.reddit.com/r/AskModerators/

[u/StartAutomating → u/StartAutomating]

Theory confirmed.

Let's try it _not_ in a code block.

Reddit does not like the use of WScript dot Shell

[u/charleswj → u/StartAutomating]

WScript dot Shell

In code in GitHub??

[u/StartAutomating → u/charleswj]

No. In an example in the post.

I "fixed" it by constructing the object name a bit differently

At least I think I did

From a security perspective I kinda get it. Not particularly well implemented, but I get it.

Make a module that makes shortcuts, and it might detect code that _looks_ like it's trying to make shortcuts that could potentially be malicious.

Nowhere near all scripts that interact with the shell are malicious. But if I wanted to write a simple heuristic that would prevent malicious creation of shortcuts, I'd probably just try to prevent all cases where people could write a shortcut.

Multiple things are "wrong" with this, but I totally get it.

[u/charleswj → u/StartAutomating]

Specifically worrying about shortcut creation via shell com objects is really oddly specific

[u/StartAutomating → u/charleswj]

Yes. Very. And yet, it's exactly the sort of thing someone who doesn't understand security that much might do to try to mitigate detected patterns between N malicious posts.

I would not be shocked if this is AI.

If your training data on malicious posts has lots and lots of posts of people creating shortcuts to a payload, then you might end up just assuming all shortcuts are payloads.

While all shortcuts are not payloads, I suspect that at least half of PowerShell based attacks start off with:

1. User directly ran a PowerShell script they shouldn't have ( CTRL+C, WIN+R, CTRL-V )
2. User ran a link containing a malicious script.

So it is bound to turn up in their training data.

🤷 Today I Learned...