Investigating PowerShell Attacks
Presenters detail vulnerability discovery and exploitation in Investigating PowerShell Attacks.
Summary
Overview: Over the past two years, we've seen targeted attackers increasingly utilize PowerShell to conduct command-and-control in compromised Windows environments. If your organization is running Windows 7 or Server 2008 R2, you've got PowerShell 2.0 installed (and on Server 2012, remoting is enabled by default!). This has created a whole new playground of attack techniques for intruders that have already popped a few admin accounts (or an entire domain). Even if you're not legitimately using PowerShell
Key Topics: to administer your systems, you need to be aware of how attackers can enable and abuse its features.
Related talks
BruCON Security Conference·1 hr
Matt Hastings · Ryan Kazanciyan
Matt Hastings analyzes 04 - BruCON 0x0A - (Re)Investigating Powershell attacks.
BruCON Security Conference·50 min
Matt Hastings · Ryan Kazanciyan
Matt Hastings examines BruCON 0x06 - Investigating Powershell attacks.
Black Hat Europe 2025·37 min
Gili Tikochinski · Yaara Shriki
Security researchers examine technical aspects of From Live Exploitation to Zero-Day Discovery: Investigating Attacks on Gogs.