CriticalLY

I personally investigated a real SOC incident where a simple USB folder triggered a VBScript worm.

The case study walks through: How legacy scripts and social engineering bypass modern defenses Browser shortcut hijacking for persistence Worm propagation via removable drives Indicators of Compromise Dynamic analysis with Any.run

I came across an interesting NTFS behavior where adding a trailing space in a Windows directory path creates a “ghost” folder that Explorer and most tools can’t display or access normally.

Attackers can abuse this to drop files inside what appears to be the real System32 directory, making the content extremely hard to notice.

I wrote a short breakdown with examples and behavior analysis.