WTFBins

Services created as part of this application installation and usage will create or rename files with a .crypt extension.

The Block64 Discovery Agent uses Impacket's psexec module, scaring SOC analysts everywhere when it's deployed.

pia-daemon emits 'ICMP Flood' behavior every minute.

IP Geo-Location Extension Attribute Closely Resembles Keylogger Behavior

Podman Desktop writes .vbs to the Startup folder.

Adobe performs...process injection??

Another bin with an identity crisis.

Microsoft loves to look like malware, huh?

What is it with antivirus and weird DNS?

A little wmic enumeration

Nothing to see here

Who needs protection?

TFW the vuln scanner runs offensive tools.

IBM's pcsnp.exe just...what

Nacho dwm

JetBrains queries security tools.

IBM creates WMI false positives

Windows being sus?

Cisco enumerates your system.

Adobe Reader for no reason starts a subprocess using the command line "I run".

WMIExec-ish NDCC

Windows Terminal runs wsl on startup.

Bizarre sub-processes.

Windows uses random high service ports for a variety of functions.

The Nim language installer binaries in certain versions trigger Windows Defender.

Yet another base64-loving process.

How much can an EDR look like malware?

It runs whoami because it's lost.

Guests are not invited to Everyone shares.

Base64-encoded PowerShell from Azure's own agent!

Random file extensions from iManage

Whoami?

SenseNDR base64 encoding

Avast scans your network on the sly.

EaseUS and bizarre Scheduled Tasks.

Everybody loves a big DNS query!

McAfee also loves big DNS queries!

Not just bad guys run whoami.

Palo Alto GP Firewall HIP check runs whoami.exe as SYSTEM.

Bizarre DNS requests on Samsung phones.

Yet another PowerShell weirdo.

EDRs 🤝 Malware Encoded PowerShell

Ivanti does some weird stuff

A little LSASS, as a treat.

Named after legitimate Windows binaries, in the wrong location.

Not the Bloodhound you're thinking of.

How to look like malware, by RingCentral

Who doesn't love CScript?

Do you like giant DNS queries?

Windows Config Manager CCM.exe runs b64-encoded powershell.