0

I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish.

Say I'm attacking a Windows machine and host an SMB share from my Linux machine with malware in that share. I want to run the malware from that share on the victim machine.

Would AV try to quarantine/delete the malware when it's not on the local machine? If not, can running straight from a share circumvent some AV protections?

1
  • Most security products scan remote files by default. They typically have policy options to disable remote files from being scanned or make exclusions, e.g. Drive, UNC path, etc. The products may differ slightly in approach, some might scan as the file is read, others might only scan the file as it's executed. I think it's fair to say results may vary. Mar 3 at 22:51

2 Answers 2

1

You are mixing two different concepts here: storage and execution.

When you use the SMB share, you are using the remote machine as the storage and mounting it locally. Real time protection will deny access to infected files, so you won't be even able to copy them to another folder. If configured to scan and take action on remote drives, your antivirus will try to quarantine infected files on the remote host.

If you are connected to a large remote share (a couple hundred terabytes), don't expect your antivirus to scan everything on that share: that would mean your machine downloading everything and scanning the files locally. Multiply that traffic by everyone connected to the share and the storage and the router would be pretty sad.

On the other hand, if you try to execute, copy or open anything from a remote share, your antivirus will step on and scan the file before giving you control.

When you say you want to execute malware on the remote machine, we are using the execution concept. Here your machine have nothing to do with anything. The execution will run on the remote machine, running software stored on the remote machine. Your antivirus will not notice anything, because it's entirely outside of its reach.

4
  • So does that mean malware from a share won't be noticed/scanned because it's not local? Mar 4 at 3:15
  • No, it does not mean that. It means real time protection WILL notice if you open it, but usually antivirus won't recursively scan every single folder from shares. Imagine having a slow network and being connected to a several PB drive, and your antivirus scanning every single file there...
    – ThoriumBR
    Mar 4 at 8:55
  • So basically it won't scan until you attempt to run the executable? Mar 4 at 10:13
  • ...or you open the folder on the file explorer, or try to copy it.
    – ThoriumBR
    Mar 4 at 10:43
0

The filesystem is mounted locally on Windows. It is handled mostly just like an internal hard drive so I'd expect an AV to handle this the same as any other malware on a local drive. If in doubt, why not test it?

1
  • AV won't handle it like a local drive because it isn't a local drive.
    – ThoriumBR
    Apr 4 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.