Revoke-Obfuscation - PowerShell Obfuscation Detection and Evasion Using Science

Revoke-Obfuscation - PowerShell Obfuscation Detection and Evasion Using Science

Explore the world of PowerShell obfuscation detection and evasion techniques in this Black Hat conference talk. Delve into the challenges of distinguishing between legitimate and malicious PowerShell usage in environments where it's heavily utilized. Learn about remote download cradles, command invocation methods, and various obfuscation techniques. Discover how to leverage character frequency analysis, cosine similarity, and machine learning algorithms for detection. Gain insights into building a PowerShell corpus, using AST Explorer, and implementing script block logging. Understand the importance of whitelisting and stay up-to-date with the latest references in PowerShell security.