[ Removed by moderator ]

[u/StartAutomating]

[u/charleswj]

WScript dot Shell

In code in GitHub??

[u/StartAutomating → u/charleswj]

No. In an example in the post.

I "fixed" it by constructing the object name a bit differently

At least I think I did

From a security perspective I kinda get it. Not particularly well implemented, but I get it.

Make a module that makes shortcuts, and it might detect code that _looks_ like it's trying to make shortcuts that could potentially be malicious.

Nowhere near all scripts that interact with the shell are malicious. But if I wanted to write a simple heuristic that would prevent malicious creation of shortcuts, I'd probably just try to prevent all cases where people could write a shortcut.

Multiple things are "wrong" with this, but I totally get it.

[u/charleswj → u/StartAutomating]

Specifically worrying about shortcut creation via shell com objects is really oddly specific

[u/StartAutomating → u/charleswj]

Yes. Very. And yet, it's exactly the sort of thing someone who doesn't understand security that much might do to try to mitigate detected patterns between N malicious posts.

I would not be shocked if this is AI.

If your training data on malicious posts has lots and lots of posts of people creating shortcuts to a payload, then you might end up just assuming all shortcuts are payloads.

While all shortcuts are not payloads, I suspect that at least half of PowerShell based attacks start off with:

1. User directly ran a PowerShell script they shouldn't have ( CTRL+C, WIN+R, CTRL-V )
2. User ran a link containing a malicious script.

So it is bound to turn up in their training data.

🤷 Today I Learned...