Detecting and Investigating Malicious PowerShell

No ratings

Presented at TechnoSecurity&DigitalForensics 2019 by

Hoke Smith

PowerShell is a favorite tool of a range of threat actors. State actors, criminal gangs, and individual hackers have all incorporated PowerShell in highly effective “fileless” attacks, resulting in damaging compromises. While PowerShell usage can be detected in real time, distinguishing legitimate from malicious use can be challenging. In this session, attendees will learn: How PowerShell is typically used in fileless attacks; How malicious use can be distinguished from legitimate use; Useful techniques to investigate PowerShell in both real time (live streamed); and Post-event (forensics) datasets