3 ms·
The script doesn't inject. But a lot of malware downloads a script and runs it, so you'd hit another rule.
by sim7c00 3y ago
The script doesn't inject. But a lot of malware downloads a script and runs it, so you'd hit another rule.
- kazinator 3y agoThe way I understand it, the uninstaller program that wants to delete itself doesn't have to download the script from anywhere; it generates the script out to a file.
- sim7c00 3y agothis is true, a good heuristic would see the difference perhaps. but malicious scripts can also be generated rather than downloaded (or more commonly decrypted from some seemonly random data) so it can be hard to tell, especially given threat actors having access to security products easily while the opposite is not always true.