Well- thank you INTEL, always nice with ways of turningarb write into code executing as a service. Or set 8.3( shortname ) of another exe in the folder to that for a super stealthy persistence.pic.twitter.com/FiQgtaxO1e
Show this thread
yarh- since .exe is missing- placing a file name C:\WINDOWS\System32\ibtsiva will run before the intented C:\WINDOWS\System32\ibtsiva.exe If you set shortname of another file as ibtsiva- it will run instead, that will be hard to catch by forensics
-
-
I already wrote a post about something similar:https://dfir.ru/2020/05/18/deceptive-ntfs-short-file-names/ …
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.