One Day Sec

How can one bypass the Windows Attachment Manager warning using compressed files?

The article shows that .rar and .cab files created with `makecab` can bypass the warning under certain conditions. For example, packing an `.exe` into a `.cab` using `makecab /d compressiontype=lzx file.exe file.cab`, then saving the file after extraction by dragging it to a different path avoids the ADS addition. This bypass works on Win10 Build 14393 (1607) and earlier, but was fixed in Build 15063 (1703). Third‑party compressors like WinRAR also avoid the warning when used to extract. Refer to An interesting way of bypassing Windows Attachment Manager for the full testing procedure.
bypasscab filemakecabWinRARcompressionWindows Attachment Manager

Browse all Q&A →