B'ad Samurai 🐐<p>ClickFix and malware seem to prefer PowerShell aliases: <code>iwr</code> <code>iex</code> for obfuscation, so I thought why not simply disable and turn them into canaries.</p><p>Of course impact is highly org and user dependent, but since it's deployed per user+host profile, we can easily apply it to the primary, non-privileged or service identity.</p><p>And yes, still disable Win+R, Win+X, log and get control on EPs. If you're already hunting <code>iwr</code>, you hopefully know where they run as current user.</p><p><a href="https://infosec.exchange/tags/powershell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>powershell</span></a> <a href="https://infosec.exchange/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>clickfix</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/automation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>automation</span></a></p>