Боковое движение

[CCod]

Возможно ли бесфайловое боковое движение с помощью mshta,rundll32,regsrv32 и тд.?Как на это реагируют антивирусы?

 

[qGodless]

fileless with mshta, rundll32, regsrv32

These processes require files to work with

How do antiviruses react to this?

It will be detected

 

[CCod]

These processes require files to work with

No mshta allows u to execute scripts by url, same as rundll and regsrv aloows to execute sct files

 

[kydoimos]

Not directly. Can use methods like psexec or remote powershell to run them on another target on the network.

 

[CCod]

Not directly. Can use methods like psexec or remote powershell to run them on another target on the network.

i understand it. Im intrested if AV kills suspicious processes like rundll or mshta with url as argument

 

[qGodless]

if AV kills suspicious processes like rundll or mshta with url as argument

Yes it will