Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 563837" data-attributes="member: 32260">I noticed that &#039;Run By SmartScreen&#039; covers the &#039;shortcut with command&#039; execution.Shortcuts with&nbsp; commands written in &#039;Target&#039;&nbsp; input area, can run scripts and some other file types, using sponsors located in the System Space (wscript.exe, cscript.exe, regedit.exe, mshta.exe, mmc.exe, hh.exe, etc.). This is sometimes a weak point of whitelisting protection.&#039;Run By Smartscreen&#039; is activated through explorer context menu, so it does not have to run files with command line parameters. Actually, only the legitimate sponsor is executed, but not the file argument in the command line.For example a shortcut carrying the command:&nbsp; &#039;c:\Windows\hh.exe %TEMP%\malicious.chm&#039; , cannot open malicious.chm file (only hh.exe will be executed).<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 563837, member: 32260"] I noticed that 'Run By SmartScreen' covers the 'shortcut with command' execution. Shortcuts with commands written in 'Target' input area, can run scripts and some other file types, using sponsors located in the System Space (wscript.exe, cscript.exe, regedit.exe, mshta.exe, mmc.exe, hh.exe, etc.). This is sometimes a weak point of whitelisting protection. 'Run By Smartscreen' is activated through explorer context menu, so it does not have to run files with command line parameters. Actually, only the legitimate sponsor is executed, but not the file argument in the command line. For example a shortcut carrying the command: 'c:\Windows\hh.exe %TEMP%\malicious.chm' , cannot open malicious.chm file (only hh.exe will be executed).:) [/QUOTE]

Verification