APTs LOVE PowerShell and Why You Should Too - Anthony Rose & Jake Krasnov

Anthony Rose and Jake Krasnov examine why Advanced Persistent Threats (APTs) continually leverage PowerShell for Living off the Land (LotL) tradecraft and demonstrate how defenders can effectively detect and dissect these operations. They analyze the evolution of PowerShell attack frameworks alongside Microsoft's defensive telemetry enhancements.

The speakers explore native PowerShell capabilities that make it attractive to adversaries at 03:48 and 11:46. At 19:30, they walk through real incident case studies where defenders misattributed malicious PowerShell executions as benign administrative scripts. They demonstrate analyzing in-memory script execution and utilizing PowerShell Operational event logs (Event ID 4104 Script Block Logging and Event ID 4103) at 23:28 and 27:23. At 43:04 and 50:53, they show how to reverse-engineer obfuscated payloads generated by PowerShell Empire and detect AMSI bypass techniques.

(AI summary — Gemini Flash)