Group Details Private

VulnDetect Team Member

VulnDetect Employees

Member List
  • [VulnDetect][Custom Software] Updating SysInternals

    Based on customer requests we've examined ways to update Portable Apps, like apps form the SysInternals bundle.

    There are many ways to achieve this, but we wanted one that works well with the Custom Software feature in VulnDetect.

    We also wanted to avoid making one Config per App in the SysInternals bundle.

    And, since these files can live in various places, including folders that are writable by non-privileged users, we wanted to be careful not to overwrite the wrong files or follow symbolic links.

    The script will not overwrite files unless they have the company name specified in the $companyNameToCheck variable, it will also not touch files in the $excludedDirs.

    The combination of Custom Software and this script assumes that you add a ZIP archive as an Additonal File and that the ZIP archive contains a folder called "files" with all the SysInternal files you want to replace, e.g. the entire SysInternals bundle.

    You can also edit the $sourceDir variable if you want to use a different layout in your ZIP archive.

    The below script was created by ChatGPT (by OpenAI). It was created based on the above requirements and it has been reviewed and tested by SecTeer.

    Note: This script is intended to run in an automated fashion and with a sub folder of known trusted files. Executing this in the wrong location and altering variables and conditions may have unforeseen consequences, because the script overwrites files recursively.

    # Define the company name to check for
    $companyNameToCheck = "Sysinternals -"
    # Get the current working directory and set the source directory to the "files" subfolder
    $sourceDir = Join-Path -Path (Get-Location) -ChildPath "files"
    $drive = "C:\"
    # List of directories to exclude (common shim file locations)
    $excludedDirs = @(
    # Function to get the latest file from a directory
    function Get-LatestFile {
        param (
        $files = Get-ChildItem -Path $directory -Filter $fileName
        $latestFile = $files | Sort-Object LastWriteTime -Descending | Select-Object -First 1
        return $latestFile
    # Function to check the "Company Name" and "Product Name" properties of a file
    function Get-FileProperties {
        param (
        $properties = Get-ItemProperty -Path $filePath -Name 'VersionInfo'
        return @{
            CompanyName = $properties.VersionInfo.CompanyName
            ProductName = $properties.VersionInfo.ProductName
    # Function to recursively replace files in the target directory with the latest from the source directory
    function Replace-Files {
        param (
        # Get the list of files in the source directory
        $sourceFiles = Get-ChildItem -Path $sourceDir
        # Iterate over each file in the source directory
        foreach ($sourceFile in $sourceFiles) {
            # Get the latest version of the source file
            $latestSourceFile = Get-LatestFile -directory $sourceDir -fileName $sourceFile.Name
            # Find matching files in the drive recursively, excluding the source directory and excluded directories
            $matchingFiles = Get-ChildItem -Path $drive -Filter $sourceFile.Name -Recurse -ErrorAction SilentlyContinue | Where-Object {
                $_.FullName -notlike "$sourceDir*" -and
                $excludedDirs -notcontains $_.DirectoryName
            # Replace each matching file with the latest source file if the company name matches and it is not a Chocolatey shim file
            foreach ($targetFile in $matchingFiles) {
                $properties = Get-FileProperties -filePath $targetFile.FullName
                if ($properties.CompanyName -eq $companyNameToCheck -and $properties.ProductName -notlike "*Chocolatey Shim*") {
                    Copy-Item -Path $latestSourceFile.FullName -Destination $targetFile.FullName -Force
                    Write-Output "Replaced $($targetFile.FullName) with $($latestSourceFile.FullName)"
                } else {
                    Write-Output "Skipped $($targetFile.FullName) as it is either not from '$companyNameToCheck' or it is a Chocolatey shim file"
    # Call the function to replace files
    Replace-Files -sourceDir $sourceDir -drive $drive -companyNameToCheck $companyNameToCheck
    posted in [Corporate] Deployment -> Custom Software
  • RE: Microsoft PC Manager (Windows Installer) is EOL

    @OLLI_S There are a few users, yes.

    The website doesn't really state anything at all:

    I'll leave it as Untracked and Pre-release for now, do let me know if you see some official statement that I can link to and then we'll flag the EXE edition as EoL.

    posted in Detection Issues
  • RE: [Solved] Left Overs in WSCC

    @OLLI_S From what I can see, then detection of Rufus and SumatraPDf is working as expected. As you know, part of our detection relies on the original filenames, so when an app or user renames EXE files, it easily (and intentionally) bypasses our detection.

    posted in Solved Bundling Issues
  • RE: Cygwin Filezilla detected as Widnows Filezilla

    Is FileZilla a standard sub application of Cygwin?

    Perhaps we should bundle it?

    posted in Detection Issues
  • RE: Microsoft 365 Apps - No Longer Bundled

    @OLLI_S We actually stopped bundling it a long time ago. When I look at your results, then I see all the 365 Apps.

    There are two reasons we stopped bundling it. One is that Microsoft frequently releases unknown builds to a subset of systems, this breaks some logic that we rely upon. The other is that the Suite system doesn't support packages, so in order to support updating 365 Apps, we had to stop using the Suite bundle.

    We may change this eventually, but it's not on the roadmap at the moment.

    Btw. if some of your 365 Apps disappear, then it may be because you ran into one of those Unknown builds, please ping me directly, next time you only see some of them, then I can verify whether this is the reason.

    posted in Bundling Issues
  • RE: [Solved] FileZilla - No longer detected (Bug)

    @OLLI_S Yes, I can see they changed some properties. It should be fixed now.

    Thank you for reporting this.

    posted in Solved Detection Issues
  • RE: [RELEASE] SecTeer VulnDetect Agent v3.2.0.0 Recommended and v3.3.2.0 Preview - 2024-01-22

    Version is a available as a Tech Preview. Please install and run the Tech Preview on a few hosts and report if there are issues.

    Please test on a few selected hosts and report if you find issues:

    posted in Announcements
  • RE: [Solved] Norton Security - Vendor Incorrect

    Thank you for letting us know (btw. we base it on the legal owner of the website, not the company name in the EXE, but the legal entity on the website has changed too).

    posted in Solved Detection Issues
  • RE: [Solved] WingetUI - Installed Version recommended

    We've tweaked the detection, do let us know if it has improved.

    posted in Solved Detection Issues
  • RE: [Solved] Microsoft Edge WebView2 Runtime - Product-Page wrong

    We've updated the links for Edge and Edge WebView2, thank you.

    Edge WebView2 is a tad special, as there is different editions, some which are intended to be bundled with third party apps and then there is one which is system wide and can be shared by apps that need it.

    The system wide one can be updated by simply running the latest installer, which is what we do, when you let VulnDetect update it.

    The alternative is to let the built-in (Edge) updater update it.

    Since many different applications use WebView2, it often takes time before it is updated (i.e. it often requires a system restart because important files are in use).

    posted in Solved Detection Issues