Handling file-less attacks by blocking PowerShell?
Migo Kedem
VP, Office of the CEO & Strategic Initiatives at CrowdStrike (NASDAQ: CRWD) | Ex SentinelOne | Creator of SentinelLabs
I am writing a post covering the ways security vendors are using to demo fileless detection, without mentioning names. Some are using PowerShell block as a protection.
Really? Blocking it means sysadmin hell. It's also not effective. Few options for bypass:
- Run PowerShell with dlls only, with a simple rundll32 command using PowerShdll.
- Convert PowerShell scripts into other EXE files, with tools like PS2EXE
- Malware use it’s own copy or modify the local PowerShell so it won’t be recognized as PowerShell by security products
- Embed a PowerShell script in the pixels of a PNG file and generates a oneliner to execute using Invoke-PSImage
Are there real customers willing to block PowerShell on their entire environment?