THERE’S SOMETHING ABOUT WMI: HOW ATTACKERS USE WINDOWS SCRIPT HOST TO MAINTAIN PERSISTENCE

No ratings

Presented at Mircon 2014 by

Devon Kerr

Christopher Glyer

This presentation will build upon information discussed in the weblog post “Going to Ground with The Windows Scripting Host (WSH),” originally posted to the Mandiant weblog on February 19, 2014. This weblog post described ways that attackers have leveraged the Windows Script Host (WSH), which provides language-independent scripting capabilities for administration functions, to maintain persistence during a compromise. Participants will gain an understanding of the Windows Script Host (WSH) and Windows Management Instrumentation (WMI), how to detect an infected Common Information Model (CIM) repository, and how to remediate a system infected using these techniques.