@Wietze - Blog

Windows’ primary mechanism for shortcuts, LNK files, is frequently abused by threat actors for payload delivery and persistence.

Defensive tools like AVs and EDRs rely on command-line arguments for detecting malicious activity.

The first argument of a program’s command line, typically reflecting the program’s name/path and often referred to as argv[0], can in most cases be set to an arbitrary value without affecting the process’ flow.

By manipulating environment variables on process level, it is possible to let trusted applications load arbitrary DLLs and execute malicious code.

Many Windows applications have multiple ways in which the same command line can be expressed, usually for compatibility or ease-of-use reasons.

DLL Hijacking is a popular technique for executing malicious payloads.

PowerShell has built-in functionality to save sensitive plaintext data to an encrypted object called SecureString.

By adding two parameters to any Google Search URL, you can replace search results with a Knowledge Graph card of your choice.