INVESTIGATING POWERSHELL ATTACKS - FireEye

Windows PowerShell has a few cmdlets to retrieve the management data exposed by WMI. We can list these cmdlets by using: #Use Get-Command and mention WMI* as the Noun Get-Command -Noun WMI* There are five cmdlets that are used to work with WMI. However, within the scope of this book, we shall use Get-WMIObject and Register-WMIEvent only. Get ... ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download