Главная
Study mode:
on
1
Team Spicy Weasel
2
What is PowerShell & is it DEAD?
3
Evolution of Poshc2 2016 - 2019
4
Generic PowerShell Implant
5
Carbon Black / Tanium/ EDR
6
Defensive / Legacy Approach Reactive
7
Example Vendors
8
Attacker Thoughts
9
Avoidance - Carbon Black
10
Trickery
11
Parent PID Spoofing / Carbon Black
12
Detecting Parent Spoofing
13
EDR Hooking
14
Bringing Back The Good Times
15
Demo - Before
16
Demo - After
17
Migrating with COM into IE
18
The key to this? Junction folders
19
How can we use that
20
Shell windows
21
Getting the reg keys
22
EDR Summary
23
Future Predictions
Description:
Explore the evolving landscape of PowerShell and its role in cybersecurity through this in-depth conference talk from Security BSides London. Delve into the complexities of modern attack surfaces, Windows endpoint technologies, and the challenges faced by both offensive and defensive teams. Gain insights into advanced techniques involving System.Management.Automation.dll, .NET manipulations, and process injection methods. Examine the evolution of tools like PoshC2 and its C# implant, while learning about common operational security pitfalls and detection strategies. Discover the future of memory-resident malware and the changing dynamics of red teaming over the next 12-18 months. Through demonstrations and expert analysis, uncover the nuances of PowerShell's alleged demise and its continued relevance in specific environments.

Powershell Is Dead - Epic Learnings

Security BSides London
Add to list