PowerShell obfuskation Techniques & How To Detect Them​

on YouTube ↗49m

" summary

Describes a dozen never-before-seen techniques that mutate PowerShell command arguments so common detections fail, demonstrates concrete methods like tick escapes inside member names, splatting/wildcarded cmdlet names, reversing and reordering string payloads, using securestring as payload to store AES/DPAPI-encrypted scripts, and pushing commands into parent or grandparent processes via environment variables or standard input. Shows evasion of encoded command and remote download cradle detections and ships the open source tool Invoke-Obfuscation which reliably generates and tests these techniques.

AI-written summary · about

" chapters (25)

1. 0:00Start
2. 5:45preparing your environment
3. 6:49download a powershell script into memory
4. 9:15set new object net web client as a variable
5. 10:08add a tick mark
6. 10:45put tick marks in front of every letter
7. 12:31use tick marks
8. 13:55use wildcards to search
9. 15:09powershell 10 syntax
10. 17:10treat the commandment name as a string
11. 21:38automate this in powershell
12. 25:16split the string
13. 28:40append a wild card to the end of a flag
14. 29:20take a random substring
15. 31:09convert it to a secure string object
16. 31:58using aes encryption 16 24 or 32 bit
17. 35:27echo our powershell command into powershell
18. 36:50setting your powershell command in a process level environment
19. 37:19pipe your command in the clipboard
20. 38:41use the clipboard
21. 41:44using the remote download cradle
22. 44:11randomize the order
23. 45:41move the arguments outside of powershell
24. 46:36invoke an environment variable
25. 47:29push the arguments

" related talks

• 43mMalicious Payloads vs Deep Visibility: A PowerShell StoryDaniel Bohannon · PowerShell + DevOps Global Summit 2019
• 01h 04mD1T2 - Techniques FOR %F IN (-style) DO (S-level CMD Obfuscation)Daniel Bohannon · Hack In The Box Amsterdam 2018
• 01h 40mDefending against PowerShell attacks - in theory, and in practiceLee holmes · PowerShell + DevOps Global Summit 2018
• 41mPowerShell Sandbox — Build It Yourself!Dawid Pachowski · CONFidence 2019
• 27mUsing PowerShell as a Reverse Engineering ToolMatt Graeber · PowerShell Summit North America 2014
• 49mPowerShell for Security Incident ResponseLee holmes, Joe Bialek · PowerShell Summit North America 2014
• 25mInvestigating PowerShell AttacksRyan Kazanciyan, Matt Hastings · Black Hat USA 2014
• 48mStop Writing Insecure PowerShell... Seriously.Rob Pleau · PowerShell + DevOps Global Summit 2025