Advanced Obfuscation
Last updated
Last updated
Use the caret (^) escape character to avoid static/pattern searching
The final obfuscation characters uncovered during this research are the comma and semicolon. The comma and semicolon are almost always interchangeable with one another and can be placed almost anywhere that whitespace is allowed in cmd.exe command line arguments. These characters can even serve as delimiters in places where whitespace delimiters are typically required (easily breaking the previous sample regular expression term echo\s):
The COMSPEC environment variable contains a 27-character value which is the full path to cmd.exe.