How does AV know when a process is malicious if it doesnt have a known hash?
🗣Diesl

All AVs have a database of known malicious code and extensions. If the hash is unrecognized it may get quarantined.
👤latnGemin616


🎖@malwr

Image displays its own MD5 hash
🗣ASIC_SP

Absolute noob question incoming... What are some practical uses for this?
👤WhatArghThose

There's a mathematical function (maybe in parametric form) whose graph is the "picture of the algebraic equation" of the function itself. I can't find it right now. [not exactly correct, see below\]

EDIT:

Tupper's self-referential formula:

https://en.wikipedia.org/wiki/Tupper%27s_self-referential_formula
👤Acrobatic-Cause-4925

See also: This PDF is an NES ROM that prints its own MD5 hash!
👤cbarrick


🎖@malwr

Exploit for Arbitrary File Move vulnerability in ZoneAlarm AV [PDF+EXPLOIT](https://github.com/Wh04m1001/ZoneAlarmEoP)
🗣soupcreamychicken


🎖@malwr

Microsoft Shift F10 bypass + Autopilot privilege escalation
🗣k4m1ll0

Am i missing something, or could you just as easily pop out the harddisk and put it in another machine to remove the DisableCMDRequest.TAG file/do whatever you want?
👤Bl00dsoul

There are ways to disable it: https://call4cloud.nl/2022/01/the-oobe-massacre-the-beginning-of-shift-f10/

Another attack vector would be audit mode at beginning of setup. After creating admin accounts or whatever sysprep back to OOBE to continue with autopilot
👤HankMardukasNY

This vuln is fairly well-known in the Intune community, but mostly theoretical - great to see a writeup and full attack chain. Do you have any recommendations for mitigating it? I've focused on using preprovisioning to lock down the system and defaultuser0, but being able to alt-tab and modify system state at all seems like a huge attack surface
👤Pl4nty


🎖@malwr