Defending against PowerShell attacks - in theory, and in practice

on YouTube ↗01h 40m

" summary

Phishing docs with VBA macros and base64 stagers repeatedly deliver initial code execution, then attackers pivot to PowerShell one-liners that download and run payloads; blocking powershell.exe fails because hosts and libraries still expose the engine. The talk demonstrates script block logging, module and pipeline logging and protected event logging, shows AMSI hooking into Windows Defender (and adoption by Kaspersky and Cylance), and presents Revoke-Obfuscation: an AST‑based classifier that improves detection (character‑frequency gave 89% precision 37% recall; AST/logistic models detect ~94% of obfuscated scripts).

AI-written summary · about

" chapters (59)

1. 0:00Introduction
2. 1:54What does one look like
3. 2:17Phishing attacks
4. 3:03Enabling macros
5. 5:35APT example
6. 6:26Palo Alto
7. 7:27Security Research
8. 8:41Quality of Life
9. 9:20Lets block PowerShell
10. 9:34The problem with PowerShell
11. 10:22The intelligence behind PowerShell
12. 11:16The MITRE attack framework
13. 12:03The Lua interpreter
14. 12:57Security controls
15. 15:25PowerShell apologist
16. 17:08No one talking about Python
17. 19:06Configuration
18. 19:32Module Pipeline Logging
19. 20:16System Transcripts
20. 22:12Script Block Logging
21. 23:18Obfuscated PowerShell
22. 24:15Antimalware scan interface
23. 26:34Protected event logging
24. 28:01Useful PowerShell events
25. 32:46Security transparency
26. 34:27Daniel Bohannon
27. 35:55Collect logs
28. 36:46The canonical detection challenge
29. 39:21The PowerShell download cradle
30. 40:07What are your options
31. 40:26Start to use your SEM
32. 40:54Use string concatenation
33. 41:31Use escape characters
34. 41:47New object
35. 42:22wildcards
36. 43:01get command
37. 43:19forget alias
38. 43:30VOC expression
39. 44:13PowerShell obfuscate
40. 44:25Reverse strings
41. 45:54Example from 2010
42. 47:30Character frequency analysis
43. 48:19Cosine similarity
44. 49:05Script similarity
45. 49:30Script similarity analysis
46. 50:07Underhanded PowerShell contest
47. 51:05GitHub
48. 52:40Thanks
49. 53:24Scary stuff out there
50. 53:35The depths of depravity
51. 54:05Statistics
52. 55:01Precision and Recall
53. 56:23We can do better
54. 56:33Tokenizer
55. 57:10AST
56. 57:41Pattern analysis
57. 58:38Celebrating 5000 features
58. 58:51Linear regression
59. 59:32Linear regression in Excel

" related talks

• 43mMalicious Payloads vs Deep Visibility: A PowerShell StoryDaniel Bohannon · PowerShell + DevOps Global Summit 2019
• 25mInvestigating PowerShell AttacksRyan Kazanciyan, Matt Hastings · Black Hat USA 2014
• 47mAMSI: How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does ItNikhil Mittal · Black Hat USA 2016
• 49mPowerShell obfuskation Techniques & How To Detect Them​Daniel Bohannon · CODE BLUE 2016
• 52mStart covering your bases & Stop chasing APT headlinesAvishay Zawoznik · NDC London 2025
• 45mPowershell Kung-FuPaweł Maziarz · CONFidence 2019
• 57mSecuring PowerShell: Hands-On LabAshley McGlone · PowerShell + DevOps Global Summit 2019
• 42mStart Covering Your Bases And Stop Chasing APT HeadlinesAvishay Zawoznik · Global AppSec Lisbon 2024