Windows 10 Store 'wsreset' tool lets attackers bypass antivirus

guest · Jul 20, 2020

Windows 10 Store 'wsreset' tool lets attackers bypass antivirus
July 20, 2020
https://www.bleepingcomputer.com/ne...wsreset-tool-lets-attackers-bypass-antivirus/

A technique that exploits Windows 10 Microsoft Store called 'wsreset.exe' can delete bypass antivirus protection on a host without being detected.

Wsreset.exe is a legitimate troubleshooting tool that lets users diagnose problems with the Windows Store and reset its cache.
Pentester and researcher Daniel Gebert has discovered that wsreset.exe can be abused to delete arbitrary files.

As wsreset.exe runs with elevated privileges because it deals with Windows settings, this bug would allow attackers to delete files even if they would not normally have the privileges.
Click to expand...

The exploitation technique mentioned here relies on a simple concept of “folder junctions” which are similar to, but a more limited version of symbolic links (symlinks). [...] Gelbert explains in his blog post
Abusing wsreset to bypass antivirus software
The researcher demonstrated how this behavior could be abused to bypass antivirus protections, focusing on Adaware as an example.
Click to expand...

Log in or Sign up

Windows 10 Store 'wsreset' tool lets attackers bypass antivirus

guest Guest

Log in or Sign up

Windows 10 Store 'wsreset' tool lets attackers bypass antivirus

guest Guest

Useful Searches