Главная
Study mode:
on
1
Intro
2
PowerShell Exploitation
3
What is set? What version?
4
Audit with LOG-MD
5
PS Event IDs - Windows PowerShell
6
PS Event IDs - PowerShell/Operational
7
What is Malware Using?
8
Exploit Kits
9
Typical Malware launching PowerShell
10
Did that look normal?
11
They do this to hide what you see
12
PowerShell Logs show it too
13
Base64 Encoded
14
Manual Translation
15
PS Base 64 blob
16
4104 Decodes Base64 blobs
17
Obfuscation - Odd stuff - 4688
18
Script Blocks are labeled
19
This is a normal Script Block
20
WARNING !!!!
21
4100 - Executing Pipeline
22
PS v2 - 500 Events
23
Filtering out the good, to find the bad
24
Code your PowerShell for exclusion
25
Create Email Alerts
26
PowerShell Log Goodness
27
Security Log
28
PowerShell v5
29
How do I hunt for PS?
30
Summary
31
Resources
32
Questions?
Description:
Explore PowerShell exploitation techniques, including PowerSploit, Bloodhound, and PowerShellMafia, in this 50-minute conference talk from ShowMeCon 2018. Delve into PowerShell security, event logging, and malware detection methods. Learn about obfuscation techniques, base64 encoding, and script block logging. Discover how to filter logs, create email alerts, and effectively hunt for malicious PowerShell activity. Gain insights into PowerShell versions, audit logging, and best practices for securing your environment against PowerShell-based attacks.

PowerShell Exploitation - PowerSploit - Bloodhound - PowerShellMafia - Obfuscation

Add to list
0:00 / 0:00