Analyzing PowerShell Payloads Part 7

Episode 7: Extracting the tactical intel from a PowerShell based Covenant payload.

"Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a web-based interface that allows for multi-user collaboration"

Covenant Repo:

DnSpy Repo:

Write assembly data to file
#$test = (gv o).Value.ToArray()

Retrieve the properties of the assembly code
#$Assembly = [Reflection.Assembly]::Load((gv o).Value.ToArray())
#$Assembly | fl *

Sample Link:

--

John Dwyer
--

Disclaimer: Samples shown in the video were pulled from open source intel locations and we don't recommend accessing the associated IPs or domains.