0

I am studying ethical hacking and I work in the cybersecurity department of a company.

I have been testing a hacking program but some PCs delete this executable as soon as I plug in the USB and some don't.

I have been trying some things but I can't get anything without an external antivirus.

My questions are:

  • How can I force Windows to detect this and delete the suspicious executables?
  • How could I bypass this measure and execute my program?
Improve this question
3
  • 3
    I'm worried that some PCs do not delete it. What is different about those PCs?
    – schroeder ♦
    Aug 29, 2022 at 9:56
  • 2
    The term you are looking for is "AV evasion". There are quite a lot of tools to help with this.
    – schroeder ♦
    Aug 29, 2022 at 9:56
  • @schroeder thanks, that helps me a lot, I didn't know how to search for this kind of information
    – Alex
    Aug 29, 2022 at 9:57

1 Answer 1

Reset to default
-2

I'm not sure if there is a way to force Windows Defender to do this exactly. But you can change the settings in the registry to stop all autoplaying of files from USB devices which is a good start.

There are a number of common ways of bypassing this, one way is to pack/crypt/obfuscate the exe/bat so the AV won't recognize it. AV evasion is a complicated topic but a simple example is: Anti virus detects malware by scanning the file for known code/string snippets. So you may have a batch script that contains the string C:\Windows\System32 which gets flagged so you can encrypt that string in the script and then decrypt it at run time.

Another way I have seen is by using malicious USB tools like rubber ducky. Where basically the computer will recognize the device as a keyboard so someone can program it to open powershell and download and run a malicious file by simulating key presses.

Improve this answer
4
  • 1
    Auto-play and rubber ducky are completely irrelevant to the question. This answer would be greatly improved if you cut those parts and expanded on the AV evasion techniques you mentioned.
    – schroeder ♦
    Aug 29, 2022 at 12:59
  • Please respond to comments in the comment field. Please do not editorialise in posts.
    – schroeder ♦
    Aug 29, 2022 at 17:38
  • Auto-play has absolutely nothing with Defender or AV. Scans are performed when the media is mounted, not when files are executed. And rubber ducky devices either need to be purchased specifically, or, if you have more comfort, you can reprogram a microcontroller. Neither options are relevant to what was asked.
    – schroeder ♦
    Aug 29, 2022 at 17:40
  • This is why I said "which is a good start", I meant it's good practise. Regarding your second point I'm not sure if that's strictly correct. I think most AV these days will scan process memory whilst it's running but I could be wrong. microsoft.com/security/blog/2018/09/27/…
    – thenullptr
    Aug 29, 2022 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .