List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. System security settings are the first line of defense against the most common attack vectors. For that reason, attackers often aim to tamper with system security settings. Disabling User Access Controls (UAC) and other security settings enables malicious code to execute without being blocked. While the presence of code that tampers with system security settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with system security settings. One example of acceptable use for such functions is allowing specialized applications to install as services that monitor the operating system events.
Prevalence in PowerShell Gallery community
6 packages
found in
Top 100
84 packages
found in
Top 1k
753 packages
found in
Top 10k
1.56k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1562.001 - Disable or Modify Tools.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.
Prevalence in PowerShell Gallery community
14 packages
found in
Top 100
179 packages
found in
Top 1k
969 packages
found in
Top 10k
1.76k packages
in community
Next steps
Investigate reported detections.
If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.
You should delay the software release until the investigation is completed, or until the issue is risk accepted.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Software components sometimes need to interact with higher privilege parts of the operating system, often requiring administrative access to accomplish a task. Machine power settings are high privilege functions that can change the power state of the device. This includes the ability to reboot and shutdown computer systems. Attackers often abuse machine power settings to force a system reboot, upon which malicious code can infect the system and gain persistence. While the presence of code that tampers with machine power settings does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that interact with the machine power state. One example of acceptable use for such functions is prompting users to reboot their system during complex software installations.
Prevalence in PowerShell Gallery community
4 packages
found in
Top 100
46 packages
found in
Top 1k
201 packages
found in
Top 10k
389 packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1529 - System Shutdown/Reboot.
Consider rewriting the flagged code without using the marked behaviors.
Problem
Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.
Prevalence in PowerShell Gallery community
9 packages
found in
Top 100
176 packages
found in
Top 1k
972 packages
found in
Top 10k
1.9k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.