Главная
Study mode:
on
1
Introduction
2
Who am I
3
Audience
4
Agenda
5
What is PowerShell
6
Why is PowerShell important
7
Exploit frameworks
8
PowerShell is extremely flexible
9
PowerShell is important to miner
10
Querying PowerShell logs
11
PowerShell logs
12
References
13
Analyzing PowerShell Data
14
Evasion Tactics
15
Special Characters
16
Cosine Similarity
17
HighLevel Features
18
Machine Learning
19
Documentation
20
Raw Events
21
Transformation
22
Sample Event
23
Algorithm Evaluation
24
Results
25
Accuracy
26
Precision
27
Random Force
28
Lessons Learned
29
Overfitting
30
Normalized Data
31
Get More Data
32
Measure Your Performance
33
Code Names Stick Around
34
Detection Efficacy
35
RealTime Pipeline
36
Merging work
37
Data set
38
Questions
Description:
Explore the world of PowerShell classification and its implications for cybersecurity in this BSidesLV conference talk. Delve into the importance of PowerShell, its flexibility, and its role in exploit frameworks. Learn about querying and analyzing PowerShell logs, evasion tactics, and the application of machine learning techniques for detection. Discover insights on high-level features, cosine similarity, and algorithm evaluation. Gain valuable lessons on overcoming challenges such as overfitting, data normalization, and performance measurement. Understand the significance of real-time pipelines and data merging in enhancing detection efficacy. Engage with a comprehensive overview of PowerShell classification that bridges technical knowledge with personal growth and self-discovery.

PowerShell Classification - Life, Learning, and Self-Discovery

BSidesLV
Add to list