Handling file-less attacks by blocking PowerShell?

Handling file-less attacks by blocking PowerShell?

I am writing a post covering the ways security vendors are using to demo fileless detection, without mentioning names. Some are using PowerShell block as a protection.

Really? Blocking it means sysadmin hell. It's also not effective. Few options for bypass:

  1. Run PowerShell with dlls only, with a simple rundll32 command using PowerShdll.
  2. Convert PowerShell scripts into other EXE files, with tools like PS2EXE
  3. Malware use it’s own copy or modify the local PowerShell so it won’t be recognized as PowerShell by security products
  4. Embed a PowerShell script in the pixels of a PNG file and generates a oneliner to execute using Invoke-PSImage

Are there real customers willing to block PowerShell on their entire environment?

要查看或添加评论,请登录

Migo Kedem的更多文章

社区洞察

其他会员也浏览了