Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science

Описание к видео Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science

Attackers, administrators and many legitimate products rely on PowerShell for their core functionality. However, being a Windows-signed binary native on Windows 7 and later that enables reflective injection of binaries and DLLs and memory-resident execution of remotely hosted scripts, has made it increasingly attractive for attackers and commodity malware authors alike. In environments where PowerShell is heavily used, filtering out legitimate activity to detect malicious PowerShell usage is not trivial.

by Daniel Bohannon & Lee Holmes

Full Abstract & Presentation Materials:
https://www.blackhat.com/us-17/briefi...

Комментарии

Информация по комментариям в разработке

Похожие видео