Investigating PowerShell Attacks
summary
Targeted attackers use PowerShell for command-and-control and lateral movement, often over WSMan/WinRM remoting, with PowerShell 2.0 present by default on Windows 7/Server 2008 R2. Real cases use PowerSploit modules like Invoke‑Mimikatz to run in memory and avoid disk. Forensics finds SOAP/XML remnants in WSMProvHost and svchost memory, Event IDs 400/403/4043/169 and WinRM logs, and WMI event‑filter persistence that creates registry keys; upgrading to module logging (PSv3+) yields clear‑text commands but produces thousands of events.
AI-written summary · about
chapters (12)
- 0:00investigating powershell attacks with ryan kazanjian and matt hastings
- 4:00mention throughout this presentation a number of different versions of powershell
- 6:55retains remnants of remoting activity
- 7:11found trace bits of powershell remoting in the kernel
- 7:29recovering some of this evidence of remoting activity
- 10:02first looking at local powershell execution and the powershell
- 10:56record the powershell console starting up
- 12:11moving out to powershell remoting
- 12:43recording the start and stop of the powershell engine
- 15:59upgrading to powershell
- 17:40use any of the existing persistence mechanisms in windows
- 20:23create a wmi event filter
related talks
49mPowerShell for Security Incident Response
01h 40mDefending against PowerShell attacks - in theory, and in practice
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
37mThreat Hunting in Active Directory Environment
57mSecuring PowerShell: Hands-On Lab
45mPowershell Kung-Fu