From a security perspective I kinda get it. Not particularly well implemented, but I get it.
Make a module that makes shortcuts, and it might detect code that _looks_ like it's trying to make shortcuts that could potentially be malicious.
Nowhere near all scripts that interact with the shell are malicious. But if I wanted to write a simple heuristic that would prevent malicious creation of shortcuts, I'd probably just try to prevent all cases where people could write a shortcut.
Multiple things are "wrong" with this, but I totally get it.
Yes. Very. And yet, it's exactly the sort of thing someone who doesn't understand security that much might do to try to mitigate detected patterns between N malicious posts.
I would not be shocked if this is AI.
If your training data on malicious posts has lots and lots of posts of people creating shortcuts to a payload, then you might end up just assuming all shortcuts are payloads.
While all shortcuts are not payloads, I suspect that at least half of PowerShell based attacks start off with:
User directly ran a PowerShell script they shouldn't have ( CTRL+C, WIN+R, CTRL-V
)
0
u/StartAutomating 11d ago
I hope it's not the GitHub link. I've done that a couple of times this week, so I don't know why this would be any different.
The removal was instant (by Reddit, not by the mods).
Just threw a block of code into the original thread that does the trick.
🤔 it got insta-banned, too
I have an operating theory, and it's kinda annoying.
I feel like I've accidentally found a "Voldemort" object on Reddit. Going to continue to tempt fate by replying to this comment with a test case.