Image-like archive name masks script staging and Defender exclusion requests
A file named `N.jpg` was submitted as a script-bearing TAR archive, while process records show a file of that name passed to an archive tool and similarly named scripts run by Windows interpreters. A PowerShell command requests broad Defender exclusions, shifting the finding from unusual packaging to an attempted reduction in scanning coverage.
A Windows PowerShell process invoked tar -xf N.jpg -C $env:public: a command to extract an archive, not display a photograph. Why was a file with a JPEG-style name being passed to an archive tool? Records examined by CTX Threat Intelligence provide a concrete explanation. A submitted file named N.jpg is identified as a POSIX TAR archive containing PowerShell and VBScript components, while process events show scripts with corresponding extensions being invoked through Windows interpreters.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read