Breaking Ground·39 min
David McDonald
Shows how tree-sitter syntax queries can detect and unwrap obfuscated PowerShell before it runs, via a custom AMSI provider.
malware-analysisthreat-detectiondefensive-security+2
DEF CON 34 talks are here: 354 talks, summarized and searchable.
Browse DEF CON 341 talk in the archive.
1–1 of 1 talk
Breaking Ground·39 min
David McDonald
Shows how tree-sitter syntax queries can detect and unwrap obfuscated PowerShell before it runs, via a custom AMSI provider.