Detecting the Not-PowerShell Gang
Uncovers popular Not-PowerShell offensive tools and demonstrates how defenders can spot non-PowerShell tradecraft.
Summary
The Shift Away from PowerShell Tradecraft
Enhanced security visibility in PowerShell version 5—including Script Block Logging, Constrained Language Mode, and AMSI—pushed red teams toward alternative living-off-the-land techniques.
Emergence of Not-PowerShell Tools
Adversaries increasingly adopt compiled C# binaries, direct API invocations, and LOLBAS utilities that bypass standard PowerShell logging and monitoring configurations.
Building Resilient Host Detections
Defenders examine practical detection engineering methods using Sysmon, ETW, and process telemetry to expose unauthorized runtime executions, process injection, and unmanaged code execution.
Related talks
Blue Team Village·52 min
Jake Smith · Jack McDowell
Introduces BLUESPAWN, an open-source active defense and EDR software platform for Windows environments.
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·29 min
Anton Ovrutsky
Anton Ovrutsky demonstrates behavioral detection patterns, static parsing tools, and deobfuscation methods to hunt malicious Office VBA macros.