Malicious Payloads vs Deep Visibility: A PowerShell Story
summary
Shows real payloads and evasions: staged PowerShell loaders that use RC4 and base64 compression, token/format obfuscation and cmd.exe wrapping, AMSI bypass techniques, and lateral tools like CrackMapExec, Empire and Cobalt Strike calling mimikatz over WMI. Demonstrates that ScriptBlock logging and Transcription capture the final iex-invoked code (even if the remote C2 removes it), points to service/registry/WMI artifacts, and gives concrete detection ideas that actually find obfuscated invocations.
AI-written summary · about
chapters (11)
- 0:00PowerShell security intro
- 3:38Simple PowerShell attacks
- 6:02PowerShell forensics
- 9:50Open-source attack tools
- 12:41Empire Cobalt Strike payloads
- 19:40Forensic detection approaches
- 23:30PowerShell event logging
- 28:45Logging benefits demo
- 32:15Detecting obfuscation
- 35:45Key takeaways
- 38:14Q&A
related talks
01h 40mDefending against PowerShell attacks - in theory, and in practice
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
42mStart Covering Your Bases And Stop Chasing APT Headlines
25mInvestigating PowerShell Attacks
41m"Revenge of The Script Kiddies: Current Day Uses..."
49mPowerShell obfuskation Techniques & How To Detect Them
49mPowerShell for Security Incident Response
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home