PowerShell for Security Incident Response
summary
Demos show PowerShell used for post‑exploit tasks: Invoke-Mimikatz and token‑impersonation scripts extract NTLM hashes and Kerberos tickets and let an attacker become a domain admin over the network. Live demos enable CredSSP-enabled remote sessions that stream in‑memory payloads without touching disk, and they break constrained runspaces via Unicode quote injection to regain full language mode. Defenses shown include DPAPI/Export‑CliXml for secrets, module logging, and system‑wide transcripts.
AI-written summary · about
chapters (9)
- 0:00Start
- 9:17WINDOWS AUTHENTICATION BACKGROUND
- 28:18DEMO-CONSTRAINED RUNSPACES
- 37:03SECURE CODING
- 37:46PROPERLY QUOTING ARGUMENTS (2)
- 38:16PROPERLY COMPOSING COMMANDS
- 39:47OBFUSCATION? NO
- 41:19AVOIDING HARD-CODED SECRETS (2)
- 44:35DEALING WITH FORENSICS
related talks
25mInvestigating PowerShell Attacks
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
45mPowershell Kung-Fu
48mStop Writing Insecure PowerShell... Seriously.
01h 40mDefending against PowerShell attacks - in theory, and in practice
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field