Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
danielf-5 authored May 16, 2020
1 parent c8ff73b commit 3ab5f26
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions MSI_Payload/README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
When playing with my machines, I have realize that Windows Defender:<br>
When playing with my machines, I have realized that Windows Defender:<br>
1. does not scan \*.MSI cab files in the realtime<br>
2. excludes files dropped by msiexec.exe from realtime scan<br>


Should I tell you more? If you pack your malware into MSI, you can install it without any detection. The sample provided drops mimikatz into "C:\Program Files\Mimikatz".<br>
Additionally the WiX script was provided if you want to play with your own payload.<br>
Additionally, the WiX script was provided if you want to play with your own payload.<br>
Note: The MSI file is NOT signed by design. Play with your own code signing certificate and `Set-AuthenticodeSignature -FilePath mimi.msi -Certificate ...` <br>


Expand Down

0 comments on commit 3ab5f26

Please sign in to comment.