APTs Love PowerShell, You Should Too: Modern Offensive PowerShell Tradecraft
Anthony Rose and Jake Krasnov debunk the myth that PowerShell is dead for red teams, showing how modern adversaries weaponize PowerShell while evading AMSI and logging.
Summary
The Misconception of PowerShell's Demise
Despite the rise of C# and Go tooling, advanced persistent threat (APT) actors continue to heavily utilize PowerShell due to its native deep integration with Windows internals.
Deconstructing Modern PowerShell Security Controls
Anthony Rose and Jake Krasnov analyze Script Block Logging, Constrained Language Mode (CLM), and the Antimalware Scan Interface (AMSI).
Bypassing AMSI and Logging Protections in Memory
The speakers demonstrate practical in-memory patching techniques to disable AMSI scanning and blind Script Block Logging without administrative privileges.
Offensive Automation and Living-Off-The-Land Techniques
The authors showcase weaponizing native cmdlets for Active Directory reconnaissance, credential harvesting, and lateral movement.
Related talks
Main Stage·21 min
Rich Kelley
Rich Kelley introduces Harness, a remote PowerShell payload execution and management framework designed for stealthy interactive post-exploitation.
ICS Village·25 min
Aaron Boyd
Aaron Boyd demonstrates Living off the Land (LotL) techniques in OT environments, utilizing native engineering tools and HMI scripts to pivot undetected.
Village Presentations·51 min
Dave Kennedy
TrustedSec founder Dave Kennedy analyzes the dominance of targeted phishing attacks, demonstrating macro weaponization, PowerShell evasion, and lateral movement.