4 ms·
Many NirSoft utilities get detected. Not sure if it's still true, but back in the day it was surprisingly common to find them embedded in password stealing malw
by arsome 5y ago
Many NirSoft utilities get detected. Not sure if it's still true, but back in the day it was surprisingly common to find them embedded in password stealing malware, it'd basically run a few different password dumpers, make a zip and send it off to an FTP site. Minimal software development knowledge necessary as the whole operation could be done from a batch script.
Particularly bad malware too since anyone who reverse engineered it could get the FTP site password and download/delete all their stolen passwords.
- ogurechny 5y agoThen wmic.exe should also be listed as PUA, as you can get the product key with it. Not even mentioning Powershell and CMD — average user never runs them, while bad people do that all the time. Their appearance in the process list is a sure sign that the system WUZ HAKKED.
- arsome 5y agoYeah, I'm pretty sure I've had to ignore every PUA detection in the book. They're completely useless, especially if you pirate Microsoft stuff or use "hacking tools" like netcat. I'm not defending the behaviour, it's incredibly stupid, but it might have caught some legitimate malware in some cases where Defender itself was unable to detect the actual malicious portion.