This message was deleted.
# _general
s
This message was deleted.
n
I use PS2EXE all the time, and it works nicely: https://github.com/MScholtes/PS2EXE
👍 5
j
<Looks at site> do the executables trigger virus scanners though? Last thing I want to do is create an issue with our friendly CISO teams
n
I just read that updated note on the page. They haven't triggered it for me on both Trend Micro Apex One and Windows Defender, and I use an EXE created with that app every single day.
m
@James Rankin They should! If they don't, I would look for a better security vendor 😉
(unless they use AMSI instead)
j
No good to me then if it possibly might flag them up. Windows Defender doesn't even recognize real viruses, although it does think my GPO that disables Defender is a virus
n
I'm open to alternatives, Martin...
m
Ah, sorry, I was not questioning the value of PS2EXE (it's my conversion tool of choice as well). But if requirement is to avoid security alerts, I would be careful with any conversions of scripts to binaries: 1. Bad security vendors will do nothing 2. Better security vendors will report suspicious behavior 3. Best security vendors will use AMSI to look at what the script does - not sure about Trend Micro, but Defender is definitely using AMSI This is simplified - some AV vendors will utilize Bitdefender for AMSI-only, so it really depends on your security vendor and configuration
👍 1
w
most av will trigger on a to exe converted ps1 file. For the CU stress calculators not a single ones cares about it when using as a ps1. But when I convert it to exe while not signed and not obfuscated just about all av triggered on it. Signed and obfuscated less cared about it but some just triggered on it because they hate ps1 files coming out of executables
💯 1
✅ 1
j
Which makes it really annoying when we've got to restrict all script execution and compiling an exe is the only option for custom "routines"......
n
I have a feeling that we're headed in the same direction with regards to restricting script execution.
j
Makes me hanker for Ivanti, because the script engine in UWM didn't count as a "script"
m
You can VERY easily create your own script engine in C#. That's what Citrix Optimizer is using (UI is just using PowerShell engine)
j
Cleverer people than me probably could
m
Copy code
String FullPsFilePath = @"C:\CloudPS\" + psFile + ".ps1";

    String PsParameters = FullPsFilePath + " -psId " + psId + " -psMaster " + psMaster + " -NonInteractive";

    // Create Powershell Runspace
    Runspace runspace = RunspaceFactory.CreateRunspace();

    runspace.Open();

    // Create pipeline and add commands
    Pipeline pipeline = runspace.CreatePipeline();
    pipeline.Commands.AddScript(PsParameters);

    // Execute Script
    Collection<PSObject> results = new Collection<PSObject>();
    try
    {
        results = pipeline.Invoke();
    }
    catch (Exception ex)
    {
        results.Add(new PSObject((object)ex.Message));
    }

    // Close runspace
    runspace.Close();
It's really so simple, few lines of code
n
So easy a Martin could do it?
😄
m
So easy that team in Nanjing can do it and I can understand it 😄
🙌 1
t
I've used this guys tool converts it but the .exe remains as powershell file type which means our Mcafee doesn't let the script run which is annoying - https://ps2exe.azurewebsites.net funnily enough was trying it today! (I see that everyone has realised this situation in comments above)
a
What about using ps2exe and signing the file after? Might help with the AV issue... https://docs.microsoft.com/en-us/windows/win32/seccrypto/signtool
w
that doesn't obfuscate it and av will trigger sooner than when it's being obfuscated
I used powershell pro tools https://ironmansoftware.com/powershell-pro-tools with visual studio to obfuscate it but should also work with vs code
👀 1
j
You could package the script with iexpress which is built into win 10 https://ss64.com/nt/iexpress.html