Living Off The Land - Windows Disk Cleaner Persistence

[@seclilc]

Good stuff, John! Love catching the new videos :)

[@iam-py-test]

Thanks for making this. My only complaint is that it would be nice for you to link the websites you are talking about in the description.

[@angryman9333]

One of ur best vids, easily

[@MrPenguin098]

@John Hammond. Great presentation. You must have a photographic memory. All your videos are so smoothly presented. Thanks for your videos. I learn a lot.

[@MalamIbnMalam]

I think he just speaks naturally, he doesn't try to read off of a script.

[@seb_gibbs]

interesting that I saw the Print Monitor in the list, as this process is often false flagged on many systems I've checked over the years, so maybe its not false.

[@elmehdiraya972]

The purpose is start automatic cleanup?

[@Grave895]

Yes. But understand the damage you can cause with that registration access..

[@elmehdiraya972]

@@Grave895 thank you!

[@adrianpetrescu8583]

So what will be a better protection for this type of attack ? or how we can protect an system from that ?

[@trifalgarh]

I tried this but cleanmgr just wouldn't trigger when I follow the steps. Maybe it was patched or maybe I made a mistake somewhere? I am still debugging but as far as I can tell, I followed exact same steps. I tried on a VM with Windows 10 20H2 OS Build 19042

[@hrishikeshdahale4640]

Hey John, great video, as always! Could you make a video on Coursera's Google Cybersecurity Professional Certificate and what it is worth to someone with a CompTIA Security+ certificate. Please!!

[@Matty100]

Is it living off the land when 2 cmd screens pop up and close instantly when I turn my laptop on??

[@tomysshadow]

Not necessarily. There could be legitimate reasons that a startup program would show a command prompt window. That alone isn't enough information to determine if it's malicious or benign.

[@Matty100]

@TOMYSSHADOW thanks man!

[@jasonwestmoreland7337]

Does this work against a RAM Disk? One that you could create, populate with appropriate files, then run against, then remove after the fact? Seems that might allow you to completely hide the entire process. After all, you already have to have admin privileges to run the cleaner anyway.

[@Aera223]

Not really. I've run it without admin. Only select files need admin to be cleaned

[@MassimilianoDalCero]

Does anyone have the source code shown in the video? :)

[@KA-NV]

Excellent presentation as always. Can you provide ways to detect this?

[@notafurrysogoaway]

KZbin has apparently unsubbed me.

[@gregariousgaming6265]

weird, same for me.

[@alemswazzu]

Me three.

[@x_gosie]

This happened to me too! Why is KZbin doing it? I don't understand.

[@libanabdi2625]

Me 5

[@alnoiseplaysmc]

Yup, same.. wtf?

[@Stopinvadingmyhardware]

Python log in shells. That wasn’t funny That ginger bounce.

[@Gemini-_-]

This is Patched

[@metaatschool2207]

FIRST LIKE AND COMMENT, PIN? (Also first view)