Finding and Decoding Malicious Powershell Scripts - SANS DFIR Summit 2018

[@TjSpoonManJacques]

My personal experience with Base64 came in the form of a Rootkit - that slithered through on of those Window 10 open windows (port 445). Since Dec 2021 I have submerged in cybersecurity out of rage and unquenchable craze revenge. Even I am amazed how much I learned in 30 minutes!!! I would work with your team an entire year for FREE just to be room with super talent like this beautiful young lady! JOB WEL DONE - Much love from New Orleans

[@orca2162]

Clever cookie! I was waiting to see Wonder Woman but she was probably base encoded in the invisible plane so I missed it! Are the tools limited to base 64 encoding?

[@ravisuj]

the demonstration has been done on windows server 2008 r2. On windows server 2012 and above the event logs generated are readable in plain english. Also if the service doesn't starts how will it connect back to the meterpreter?

[@paulosilva-dm1qb]

How do we add powershell log to the eventlog

[@boratsagdiyev1586]

What to do about runtime detection. I have several backdoors wich can be scanned without going detected. As soon i execute them, i get an alert indicating a malicious file in my temp folder. ( I assume its detected from memory). Any tips to combat this?

[@Blackrose-or7fy]

Use off the land techniques

[@boratsagdiyev1586]

@@Blackrose-or7fy i prefer urban techniques

[@paulosilva-dm1qb]

Excellent!!!!

[@alifayyaz851]

Excellent

[@tenzo42o]

I just need to know, do you like python?

[@peacefultube45]

Can we use cyberchef 🕵️

[@DaNerd01]

Exactly, cyberchef is a great tool. Her entire presentation can be done in less than 30 seconds with a cyberchef cookbook.

[@zvjer2]

you are using windows and looking at a piece of code compressed with powershell so you go and try as hard as you can to decode it with.... python??

[@ItsMeooooooo]

Whats your point?

[@adekeyetemitope2301]

@@ItsMeooooooo powershell could have just been used ... @least thats what i think hes trying to say

[@amrkhled3598]

mistress at 2:20

[@logicfirst7959]

Damn, you are gonna make me hate python if you say it one more time.

[@b3twiise853]

ssssss

[@Robalo450]

Shes so hot.

[@simplelife5600]

How old is this woman??42?Doesn't look it tho.

[@orca2162]

17, from the superhero intro ;)