DSCOMPROMISED: A Windows DSC Attack Framework
summary
PowerShell toolkit DSCompromised leverages Windows Desired State Configuration to host configs on an internet server (tested in AWS), generate payloads (demo uses a netcat reverse shell), and make victims auto-reinfect via pull-mode beaconing. Configs serialize to system32\configuration as current.mof and backup.mof, Local Configuration Manager enforces consistency checker runs (default 15‑minute autocorrect, 30‑minute poll). Detection points: HTTP POSTs to psdspullserver.svc, DSC event IDs, scheduled task creation, and the DSC operational log.
AI-written summary · about
chapters (7)
- 0:00Introduction to DSC
- 1:36Understanding DSC mechanics
- 11:08The DS-compromise framework
- 19:09Weaponizing DSC via pull mode
- 26:12User persistence scenarios
- 32:36Detection and forensics
- 47:07Future outlook and Q&A
related talks
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
25mInvestigating PowerShell Attacks
50mNetwork Defender Archeology: An NSM Case Study in Lateral Movement with DCOM
39mWindows Agentless C2: (Ab)using the MDM Client Stack
36mBeing A Better Defender By Channeling Your Worst Adversary:
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
49mPowerShell for Security Incident Response