3 ms·
Then wmic.exe should also be listed as PUA, as you can get the product key with it. Not even mentioning Powershell and CMD — average user never runs them, while
by ogurechny 5y ago
Then wmic.exe should also be listed as PUA, as you can get the product key with it. Not even mentioning Powershell and CMD — average user never runs them, while bad people do that all the time. Their appearance in the process list is a sure sign that the system WUZ HAKKED.
- arsome 5y agoYeah, I'm pretty sure I've had to ignore every PUA detection in the book. They're completely useless, especially if you pirate Microsoft stuff or use "hacking tools" like netcat. I'm not defending the behaviour, it's incredibly stupid, but it might have caught some legitimate malware in some cases where Defender itself was unable to detect the actual malicious portion.