Incident Response Training, Decoding Powershell- Day 18

Показать описание

In this full series we will talk about Incident Response and it will be a Free Training Course for everyone. Today is Day-18 and we are going to explore the easiest way to read, understand, analyze, decode malicious PowerShell scripts through practical demonstration. Malicious PowerShell scripts are becoming the tool of choice for attackers. Although sometimes referred to as “fileless malware”, they can leave behind forensic artifacts for examiners to find. In this episode, learn how to locate and identify activity of these malicious PowerShell scripts. Once located, these PowerShell scripts may contain several layers of obfuscation that need to be decoded. I will walk through how to decode them, as well as some light malware analysis on any embedded shellcode. I will also demonstrate how to use some freely available tools to easily automate the process once you have discovered the MO of the attacker in your case.
First we will go through some theatrical part which any incident responder need to understand about PowerShell, why they are used and some of the basic conventions, afterwards we will show 3 samples of heavily obfuscated PowerShell and how can we decode them to identify the basics and thus take required actions.

🔗LINKs for your requirements-
-------------------------------------------------------------------------------------------------------------------------

WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!
-------------------------------------------------------------------------------------------------------------------------

⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Introduction
1:18 ⏩ Why Powershell
5:03 ⏩ PowerShell LoL example
8:00 ⏩ How to find it from Logs
18:14 ⏩ Sample1 Analysis
23:21 ⏩ Sample2 Analysis
33:28 ⏩ Sample3 Analysis
38:51 ⏩ Summarize

📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ Twitter: @blackperl_dfir

SUPPORT BLACKPERL
-------------------------------------------------------------------------------------------------------------------------
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡️ SUBSCRIBE, Share, Like, Comment

-------------------------------------------------------------------------------------------------------------------------
🙏 Thanks for watching!! Be CyberAware!! 🤞

Рекомендации по теме

Комментарии

In this full series we will talk about Incident Response and it will be a Free Training Course for everyone. Today is Day-18 and we are going to explore the easiest way to read, understand, analyze, decode malicious PowerShell scripts through practical demonstration. Malicious PowerShell scripts are becoming the tool of choice for attackers. Although sometimes referred to as “fileless malware”, they can leave behind forensic artifacts for examiners to find. In this episode, learn how to locate and identify activity of these malicious PowerShell scripts. Once located, these PowerShell scripts may contain several layers of obfuscation that need to be decoded. I will walk through how to decode them, as well as some light malware analysis on any embedded shellcode. I will also demonstrate how to use some freely available tools to easily automate the process once you have discovered the MO of the attacker in your case.
First we will go through some theatrical part which any incident responder need to understand about PowerShell, why they are used and some of the basic conventions, afterwards we will show 3 samples of heavily obfuscated PowerShell and how can we decode them to identify the basics and thus take required actions.

🔗LINKs for your requirements-

WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!

⌚
Timelines

0:00 ⏩ Introduction
1:18 ⏩ Why Powershell
5:03 ⏩ PowerShell LoL example
8:00 ⏩ How to find it from Logs
18:14 ⏩ Sample1 Analysis
23:21 ⏩ Sample2 Analysis
33:28 ⏩ Sample3 Analysis
38:51 ⏩ Summarize

📞📲
FOLLOW ME EVERYWHERE-

✔ Twitter: @blackperl_dfir

SUPPORT BLACKPERL

╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡ SUBSCRIBE, Share, Like, Comment

🙏 Thanks for watching!! Be CyberAware!! 🤞

BlackPerl

You are a great teacher. The way you explain the topics is clear and understandable. Hoping you can come up with more of this type of videos.

KA-NV

You rock! Thanks for putting this series together...

conanbradley

Love this Incident Response Training series. Thanks for these videos.

anurodhacharya

To the point !! Thanks a Ton for doing this. I have learnt many new things :)

abhinavsheel

This is excellent. Thanks for making the series

josephford

Thank you for video, video is very great. I have a question. My question is how can dowloand sample code?

servermadum

I loved your way of explanation. I didn't miss any lectures on your channel. Please share the samples with me.

saichandtadepalli

Thanks for the content. My query is how can we find whether it is encoded with Base64 or other algorithm.

varunsankar

As feedback: It would be better if you would provide samples to us to get hands-on experience. 🤞🤞

yashgoldsmith

Can you Please show how you get the decimal values from the sample loaded at the end in ghidra ?

sagibersodsky

Thanks a lot man .This is what i was looking for . Could you please share these samples ?

subhampareek

Incident Response Training, Decoding Powershell- Day 18

Incident Response Training, Decoding Powershell- Day 18

Finding and Decoding Malicious Powershell Scripts - SANS DFIR Summit 2018

Decoding Malicious PowerShell Activity

Incident Response: Azure Log Analysis

Windows Incident Response webinar Live analysis with PowerShell

Powershell:Decoded

Remoting Incident Response using Powershell

Get-Baseline : PowerShell Script for Agentless Incident Response.

Incident Response Training, Full Analysis of Sev0 Real Incident, Day 11

The PowerShell Podcast E21: 'Using PowerShell for Incident Response' with Fernando Tomlins...

Incident Response Training Course, Malicious Document Analysis, Day 15

Flip the Script: PowerShell 'Microsoft’s Incident Response Language' - Jared Atkinson

DEF CON 22 - Ryan Kazanciyan and Matt Hastings, Investigating PowerShell Attacks

Windows Incident Response Practice Lab

PowerDecode in action: Automatic deobfuscation of a malicious PowerShell script

How To Decode PowerShell

Malicious PowerShell Analysis / Blue Team Online LABS

Powershell Scripting for Security Defense

BlueTeamLabs Online - Powershell Analysis Keylogger Walkthrough

T309 Rapid Incident Response with PowerShell Mick Douglas

Incident Response Procedures with Microsoft Sentinel

Atomic Spotlight: Defense Evasion with PowerShell Encoded Command

PowerShell as a cyberattack tool - learn how it works

Deobfuscating malicious PowerShell scripts