run commands Archives

Winsage

December 29, 2025

Microsoft Adds Sudo to Windows 11 24H2 for Seamless Elevated Commands

Microsoft has introduced the sudo command in Windows 11 version 24H2, allowing users to execute commands with elevated privileges directly from a standard command prompt or PowerShell window. Users can enable this feature via Settings under System > For Developers. Sudo can run commands in three modes: “in a new window,” “with input disabled,” and “inline.” The inline mode runs the elevated command in the same console session, preserving context and variables. Microsoft has open-sourced the project on GitHub, inviting community contributions. Sudo integrates with User Account Control (UAC) for security, ensuring every elevation request is vetted. It simplifies administrative tasks for software engineers and system administrators, particularly in corporate environments where full admin access is restricted. The feature works seamlessly in Windows Terminal and supports Azure integrations. While some users have reported compatibility issues, Microsoft emphasizes that sudo is a developer tool rather than a complete replacement for Linux's sudo. Future developments may include community-driven extensions and integration with Windows Subsystem for Linux (WSL).

Tech Optimizer

November 17, 2025

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor Dragon Breath, also known as APT-Q-27 and Golden Eye, has been observed using a multi-stage loader called RONINGLOADER to deploy a modified variant of the remote access trojan Gh0st RAT, primarily targeting Chinese-speaking users. The campaign employs trojanized NSIS installers disguised as legitimate applications, such as Google Chrome and Microsoft Teams. The infection chain utilizes various evasion techniques, including a legitimately signed driver, custom Windows Defender Application Control policies, and manipulation of the Microsoft Defender binary. RONINGLOADER's attack chain involves delivering a DLL and an encrypted file labeled "tp.png," which contains shellcode. It attempts to neutralize security products by terminating processes associated with popular antivirus solutions in the region. Specific actions are taken against Qihoo 360 Total Security, including blocking network communication, injecting shellcode into the Volume Shadow Copy service, and restoring firewall settings. For other security processes, RONINGLOADER directly writes a driver to disk to perform process termination. The malware aims to inject a rogue DLL into "regsvr32.exe" to conceal its activities and launch a next-stage payload into high-privilege system processes. The final payload is a modified version of Gh0st RAT, capable of communicating with a remote server, configuring Windows Registry keys, clearing Windows Event logs, and capturing keystrokes and clipboard contents. Additionally, two interconnected malware campaigns identified by Palo Alto Networks Unit 42 employed brand impersonation to deliver Gh0st RAT to Chinese-speaking users. The first campaign, Campaign Trio, occurred between February and March 2025, while the second, Campaign Chorus, detected in May 2025, impersonated over 40 applications. Both campaigns utilized complex infection chains and trojanized installers hosted on domains that circumvented network filters. The second campaign also involved an embedded Visual Basic Script for launching the final payload through DLL side-loading.

Winsage

October 11, 2025

6 Windows Task Scheduler tricks I use instead of third-party apps

Windows Task Scheduler automates various processes without third-party applications, enhancing productivity and system performance. It can manage tasks such as reminders, cleaning, maintenance, automated backups, script execution, event-based automation, and power management. Users can create basic tasks with triggers like specific dates or system events, allowing for efficient reminders and scheduled maintenance. Task Scheduler facilitates backup processes using commands like Robocopy, ensuring reliable data management. It supports script automation in multiple programming languages and offers event-based triggers for routine tasks. Additionally, it allows for custom power management, automating shutdowns and other commands based on user-defined criteria. Overall, it serves as a versatile tool for automating numerous functions within the Windows operating system.

BetaBeacon

October 6, 2025

Android and Windows gamers worldwide potentially affected by bug in Unity game engine

A vulnerability, known as CVE-2025-59489, has been discovered in the Unity engine, widely used in game development. The bug could allow malicious files to take control of permissions granted to Unity games and run commands on a victim's device. The vulnerability primarily affects Android, Windows, Linux, and MacOS systems, but not iOS devices or gaming consoles. Unity has released fixes for the vulnerability, with no evidence of exploitation so far. Microsoft advises users to uninstall vulnerable apps and games temporarily, while Steam has announced measures to block potentially malicious command line parameters in Unity games. The bug was reported by a researcher at GMO Flatt Security, who praised Unity for promptly addressing the issue. Users are encouraged to update their software to protect against potential threats.

Tech Optimizer

September 12, 2025

Shamos malware tricks Mac users with fake fixes

A new malware campaign targeting Mac users has been identified, featuring a variant called Shamos, part of the Atomic macOS Stealer (AMOS) family, created by the cybercriminal group COOKIE SPIDER. The malware spreads through deceptive tactics that lure victims to counterfeit websites or GitHub repositories, where they are tricked into executing a command in Terminal that downloads Shamos, bypassing macOS Gatekeeper protections. Once installed, Shamos seeks sensitive information such as Apple Notes, Keychain items, browser passwords, and cryptocurrency wallets, sending the stolen data to attackers along with additional malware. The fraudulent distribution of these "fixes" is facilitated through malvertising campaigns and imitation tech support sites. Victims are encouraged to execute commands that download malicious scripts, which can capture passwords and disable file protections, allowing Shamos to maintain control even after system restarts. To protect against Shamos, users are advised to avoid running unfamiliar commands, steer clear of sponsored search results, be cautious with GitHub projects, use strong antivirus protection, consider personal data removal services, and keep macOS updated to close vulnerabilities.

Winsage

August 23, 2025

Microsoft Warns All Windows Users—This Message Is An Attack

Microsoft has issued an advisory warning Windows and macOS users about a wave of attacks known as ClickFix, which targets enterprise and end-user devices globally. ClickFix is a sophisticated social engineering tactic that deceives users into executing malicious scripts on their devices, leading to malware installation, information theft, and potential ransomware attacks. The attacks often begin with deceptive technical support popups or fake Captchas that instruct users to run commands in systems like Windows PowerShell. ClickFix relies on human intervention, allowing it to bypass traditional security measures. Microsoft emphasizes the importance of user education to recognize these threats and reduce vulnerability, as well as implementing policies to strengthen device configurations.

Winsage

February 18, 2025

100+ run commands that can help you work efficiently on Windows

Windows 11 and 10 provide run commands that streamline workflow by allowing quick access to various system tools, applications, settings, and diagnostic features. Administrative Tools: - compmgmt.msc: Opens Computer Management. - devmgmt.msc: Launches Device Manager. - diskmgmt.msc: Opens Disk Management. - services.msc: Manages background services. - eventvwr.msc: Opens Event Viewer. - secpol.msc: Opens Local Security Policy. - regedit: Opens Registry Editor. - taskschd.msc: Opens Task Scheduler. - gpedit.msc: Opens Group Policy Editor (Pro & Enterprise). System Diagnostics and Troubleshooting: - msinfo32: Opens System Information. - dxdiag: Launches DirectX Diagnostic Tool. - verifier: Opens Driver Verifier Manager. - resmon: Opens Resource Monitor. - perfmon: Opens Performance Monitor. - mdsched: Runs Windows Memory Diagnostic. - msdt: Opens Microsoft Support Diagnostic Tool. - dism /online /cleanup-image /restorehealth: Repairs Windows image. - sfc /scannow: Scans and repairs system files. - chkdsk: Runs Check Disk. - winver: Checks Windows version. - cleanmgr: Opens Disk Cleanup. File and Storage Management: - cleanmgr: Launches Disk Cleanup. - dfrgui: Opens Disk Defragmenter. - chkdsk: Checks and repairs disk errors. - diskpart: Opens Disk Partition utility. - onedrive: Opens OneDrive folder. - shell:AppsFolder: Opens all apps folder. - wab: Opens Windows contacts folder. - explorer: Opens File Explorer. - recent: Opens recent files and folders. - documents: Opens Documents folder. - downloads: Opens Downloads folder. - favorites: Opens Favorites folder. - pictures: Opens Pictures folder. - videos: Opens Videos folder. - %AppData%: Opens App Data folder. - debug: Accesses Debug folder. - backup: Opens backup folder. - %systemdrive%: Opens system drive. Security and Maintenance: - firewall.cpl: Opens Windows Defender Firewall. - wf.msc: Launches Firewall with advanced security. - ms-settings:windowsdefender: Opens Windows Security. - sigverif: Verifies file signatures. - verifier: Checks driver integrity. - msconfig: Opens System Configuration. - sfc /scannow: Runs system file checker. - dism /online /cleanup-image /restorehealth: Repairs Windows image. Launching Apps: - notepad: Opens Notepad. - calc: Launches Calculator. - snippingtool: Opens Snipping Tool. - mspaint: Opens Microsoft Paint. - winword: Starts Microsoft Word. - excel: Opens Microsoft Excel. - chrome: Launches Google Chrome. - msedge: Opens Microsoft Edge. - control: Opens Control Panel. - explorer: Opens File Explorer. - powerpnt: Opens Microsoft PowerPoint. - firefox: Opens Mozilla Firefox. - wmplayer: Opens Windows Media Player. - msra: Opens Windows Remote Assistance. - outlook: Opens Microsoft Outlook. Navigating Settings: - ms-settings: Opens main Settings app. - ms-settings:network: Opens network & internet settings. - ms-settings:display: Opens display settings. - ms-settings:personalization: Opens personalization settings. - ms-settings:windowsupdate: Opens Windows Update settings. - ms-settings:privacy: Opens Privacy settings. - ms-settings:bluetooth: Opens Bluetooth settings. - ms-settings:devices: Opens Devices settings. - ms-settings:system: Opens System settings. - ms-settings:accounts: Opens Accounts settings. - ms-settings:timeandlanguage: Opens Time & Language settings. - ms-settings:gaming: Opens Gaming settings. - ms-settings:region: Opens Region settings. - ms-settings:optionalfeatures: Opens Optional Features settings. - ms-settings:storage: Opens Storage settings. - ms-settings:notifications: Opens Notifications settings. - ms-settings:taskbar: Opens Taskbar settings. - ms-settings:start: Opens Start Menu settings. - ms-settings:lockscreen: Opens Lock Screen settings. Network and Connectivity: - ncpa.cpl: Opens Network Connections. - ipconfig: Displays IP configuration. - ping: Tests network connectivity. - control netconnections: Opens Network and Sharing Center. - ms-settings:network-wifi: Opens Wi-Fi settings. - ms-settings:datausage: View data usage. - ms-settings:network-vpn: Manage VPN. - ms-settings:network-proxy: Configures proxy settings. Display and Appearance: - desk.cpl: Opens Display Settings. - control color: Customizes window colors. - dpiscaling: Opens display scaling settings. - ms-settings:personalization: Opens Personalization settings. - ms-settings:themes: Changes desktop themes. - ms-settings:display-advanced: Adjusts advanced display settings. Accessibility: - magnify: Opens Magnifier. - narrator: Launches Narrator. - osk: Opens on-screen keyboard. - utilman: Opens Ease of Access Center. - ms-settings:easeofaccess-display: Opens display accessibility settings. - ms-settings:easeofaccess-cursor: Opens cursor accessibility settings. - ms-settings:easeofaccess-mouse: Opens mouse accessibility settings. - ms-settings:easeofaccess-keyboard: Opens keyboard accessibility settings. - ms-settings:easeofaccess-narrator: Opens narrator accessibility settings. - ms-settings:easeofaccess-magnifier: Opens magnifier accessibility settings. - ms-settings:easeofaccess-colorfilter: Opens color filter accessibility settings. - ms-settings:easeofaccess-highcontrast: Opens high contrast accessibility settings. - ms-settings:easeofaccess-closedcaptioning: Opens closed captioning accessibility settings. - ms-settings:easeofaccess-audio: Opens audio accessibility settings. - ms-settings:easeofaccess-eyecontrol: Opens eye control accessibility settings. - ms-settings:easeofaccess-mousepointer: Opens mouse pointer accessibility settings. Power Management: - powercfg.cpl: Opens Power Options. - ms-settings:powersleep: Adjusts power and sleep settings. - powercfg /batteryreport: Generates a battery report. - powercfg /energy: Creates an energy efficiency report. - powercfg /hibernate: Enables or disables hibernation. - powercfg /deviceenablewake: Enables a device to wake the computer. - powercfg /devicedisablewake: Disables a device from waking the computer.