NewApp Digest
search bot

WinRM

5 PowerShell tricks that beat Bash on Windows
Winsage
October 20, 2025

5 PowerShell tricks that beat Bash on Windows

Bash is the preferred shell for many developers in Linux environments due to its robust capabilities and flexibility. PowerShell is gaining popularity on Windows for its modern functionalities, user-friendly interface, and integration with the operating system. PowerShell handles output as objects, allowing for easier data manipulation compared to Bash, which outputs plain text. PowerShell can interact with system-level components like the registry and services, enabling tasks such as querying startup applications or managing services directly. It features cmdlets that follow a Verb-Noun syntax, making commands intuitive and reusable, and supports modules for enhanced functionality. PowerShell also excels in file management and offers remoting capabilities, allowing command execution on remote machines without third-party tools. Overall, PowerShell provides better scripting and ease of use for Windows users compared to Bash.
Scrutinizing the security of messaging apps continues.
AppWizard
May 11, 2025

Scrutinizing the security of messaging apps continues.

Customs and Border Protection (CBP) and the White House are facing scrutiny over security vulnerabilities in their messaging application. Hacktivists breached GlobalX, the airline handling U.S. deportation flights, exposing sensitive flight manifests. The FBI warned about threats exploiting outdated routers. Pearson confirmed a cyberattack compromising customer data. Research shows cybercriminals are using Windows Remote Management (WinRM) for lateral movements in Active Directory environments. A new email attack campaign is delivering a Remote Access Trojan (RAT) via malicious PDF invoices. A zero-day vulnerability in SAP NetWeaver allows remote code execution, affecting multiple sectors. An Indiana health system reported a data breach affecting nearly 263,000 individuals.
Hackers Using Windows Remote Management to Stealthily Navigate Active Directory Network
Winsage
May 10, 2025

Hackers Using Windows Remote Management to Stealthily Navigate Active Directory Network

Threat actors are exploiting Windows Remote Management (WinRM) to navigate through Active Directory environments stealthily, allowing them to bypass detection systems, escalate privileges, and deploy malicious payloads. WinRM operates on HTTP port 5985 and HTTPS port 5986, enabling remote command execution and management tasks. Attackers can gain access through compromised credentials and use WinRM-enabled PowerShell commands for reconnaissance, deploying payloads while evading detection. The attack chain includes initial access, reconnaissance, payload deployment, persistence, and lateral movement, often utilizing techniques that obfuscate malicious activities. Detecting such attacks is challenging due to the use of built-in Windows functionalities and encrypted channels. Recommended mitigation strategies include monitoring for unusual activity, restricting WinRM access, enforcing credential hygiene, and implementing advanced monitoring solutions.
Search