Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 811673" data-attributes="member: 32260">Not exactly, but anyway, from your post it follows that:<ol>
<li data-xf-list-type="ol">Eset does not prevent cmd.exe from spawning powershell.exe.</li>
<li data-xf-list-type="ol">Eset prevents powershell.exe from spawning wmic.exe.</li>
</ol>We still do not know if wmic.exe can spawn powershell.exe.My test commands were slightly different:<ol>
<li data-xf-list-type="ol">cmd</li>
<li data-xf-list-type="ol">wmic</li>
<li data-xf-list-type="ol">cmd /c powershell</li>
<li data-xf-list-type="ol">wmic process call create powershell</li>
</ol>All commands have to be run independently from Explorer! In your case, they were not.The first and the second - test if cmd.exe and wmic.exe can be executed from the Windows Explorer. If they can be executed, then:The third - can test if cmd.exe is able to spawn powershell.exe.The fourth - can test if the wmic.exe is able to spawn powershell.exe.There are many ways to execute powershell.exe, those mentioned by me are only two examples.</blockquote>

[QUOTE="Andy Ful, post: 811673, member: 32260"] Not exactly, but anyway, from your post it follows that: [LIST=1] [*]Eset does not prevent cmd.exe from spawning powershell.exe. [*]Eset prevents powershell.exe from spawning wmic.exe. [/LIST] We still do not know if wmic.exe can spawn powershell.exe. My test commands were slightly different: [LIST=1] [*]cmd [*]wmic [*]cmd /c powershell [*]wmic process call create powershell [/LIST] All commands have to be run independently from Explorer! In your case, they were not. The first and the second - test if cmd.exe and wmic.exe can be executed from the Windows Explorer. If they can be executed, then: The third - can test if cmd.exe is able to spawn powershell.exe. The fourth - can test if the wmic.exe is able to spawn powershell.exe. There are many ways to execute powershell.exe, those mentioned by me are only two examples. [/QUOTE]

Verification