Inside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques
summary
Describes using native-code hooking techniques against .NET programs to increase visibility into PowerShell execution. Explains extending and removing known limitations of AMSI on Windows by analyzing internals of the .NET Framework and the PowerShell engine, and demonstrates the approach's effectiveness.
AI-written summary · about
chapters (23)
- 0:00Start
- 1:44ABOUT MYSELF
- 3:24PERSONAL MOTIVATION
- 8:32MALICIOUS POWERSHELL VS ANTIVIRUS
- 13:45ANTIMALWARE SCAN INTERFACE (AMSI)
- 14:40SILVER BULLET
- 17:42RECAP & MOTIVATION
- 19:04NET NATIVE CODE HOOKING
- 20:05BASICS OF MANAGED PROGRAM EXECUTION 12/21
- 22:22OVERVIEW OF HOOKING
- 23:21HOW TO LOCATE AN ADDRESS OF NATIVE CODE
- 25:04EXAMPLE CODE (CH)
- 25:21HOW TO EXECUTE HOOKING MANAGED CODE
- 26:18USING UNMANAGED CODE
- 27:30USING APPDOMAINMANAGER
- 29:47POWERSHELL IS A MANAGED PROGRAM
- 31:45EMULATING AMSI ON OLDER WINDOWS PS V5
- 34:03EMULATING AMSI ON OLDER POWERSHELL
- 47:00CHALLENGES & LIMITATIONS
- 48:33TAKEAWAYS
- 49:34FOR ENTERPRISE DEFENDERS
- 50:42FOR HUNTERS & SECURITY SOFTWARE VENDORS
- 52:01ACKNOWLEDGEMENTS
related talks
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
34mWindows System Internals with PowerShell
47mAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
02h 18mHacking C# from the inside - how to do anything in .NET
49mPowerShell obfuskation Techniques & How To Detect Them
01h 40mDefending against PowerShell attacks - in theory, and in practice
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
27mUsing PowerShell as a Reverse Engineering Tool