CMD Binary Resolution via Wildcards (SENTINELONE)

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects Windows command line obfuscation where 'for' loops use the 'where' or 'dir /b' commands with wildcards to resolve and execute system binaries (LOLBins). This bypasses static string detection for common tools like certutil.exe or powershell.exe.