POWERSHELL ISE |
| 2020-09-24 | Xavier Mertens | Party in Ibiza with PowerShell |
POWERSHELL |
| 2025-02-19/a> | Xavier Mertens | XWorm Cocktail: A Mix of PE data with PowerShell Code |
| 2025-01-29/a> | Xavier Mertens | From PowerShell to a Python Obfuscation Race! |
| 2024-08-19/a> | Xavier Mertens | Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python |
| 2024-08-14/a> | Xavier Mertens | Multiple Malware Dropped Through MSI Package |
| 2024-03-28/a> | Xavier Mertens | From JavaScript to AsyncRAT |
| 2024-02-09/a> | Xavier Mertens | MSIX With Heavily Obfuscated PowerShell Script |
| 2024-01-26/a> | Xavier Mertens | A Batch File With Multiple Payloads |
| 2024-01-12/a> | Xavier Mertens | One File, Two Payloads |
| 2024-01-05/a> | Rob VandenBrink | Netstat, but Better and in PowerShell |
| 2024-01-03/a> | Jan Kopriva | Interesting large and small malspam attachments from 2023 |
| 2023-11-18/a> | Xavier Mertens | Quasar RAT Delivered Through Updated SharpLoader |
| 2023-09-09/a> | Guy Bruneau | ?Anyone get the ASN of the Truck that Hit Me?!?: Creating a PowerShell Function to Make 3rd Party API Calls for Extending Honeypot Information [Guest Diary] |
| 2023-08-03/a> | Jan Kopriva | From small LNK to large malicious BAT file with zero VT score |
| 2023-06-29/a> | Brad Duncan | GuLoader- or DBatLoader/ModiLoader-style infection for Remcos RAT |
| 2023-06-19/a> | Xavier Mertens | Malware Delivered Through .inf File |
| 2023-06-09/a> | Xavier Mertens | Undetected PowerShell Backdoor Disguised as a Profile File |
| 2023-05-17/a> | Xavier Mertens | Increase in Malicious RAR SFX files |
| 2023-04-19/a> | Rob VandenBrink | Taking a Bite Out of Password Expiry Helpdesk Calls |
| 2023-03-30/a> | Xavier Mertens | Bypassing PowerShell Strong Obfuscation |
| 2023-03-21/a> | Didier Stevens | String Obfuscation: Character Pair Reversal |
| 2023-02-10/a> | Xavier Mertens | Obfuscated Deactivation of Script Block Logging |
| 2023-01-17/a> | Rob VandenBrink | Finding that one GPO Setting in a Pool of Hundreds of GPOs |
| 2023-01-04/a> | Rob VandenBrink | Update to RTRBK - Diff and File Dates in PowerShell |
| 2022-12-28/a> | Rob VandenBrink | Playing with Powershell and JSON (and Amazon and Firewalls) |
| 2022-11-09/a> | Xavier Mertens | Another Script-Based Ransomware |
| 2022-10-31/a> | Rob VandenBrink | NMAP without NMAP - Port Testing and Scanning with PowerShell |
| 2022-10-17/a> | Xavier Mertens | Fileless Powershell Dropper |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-07-25/a> | Xavier Mertens | PowerShell Script with Fileless Capability |
| 2022-06-25/a> | Xavier Mertens | Malicious Code Passed to PowerShell via the Clipboard |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-06-03/a> | Xavier Mertens | Sandbox Evasion... With Just a Filename! |
| 2022-05-12/a> | Rob VandenBrink | When Get-WebRequest Fails You |
| 2022-04-25/a> | Xavier Mertens | Simple PDF Linking to Malicious Content |
| 2022-03-11/a> | Xavier Mertens | Keep an Eye on WebSockets |
| 2021-12-21/a> | Xavier Mertens | More Undetected PowerShell Dropper |
| 2021-12-15/a> | Xavier Mertens | Simple but Undetected PowerShell Backdoor |
| 2021-11-15/a> | Rob VandenBrink | Changing your AD Password Using the Clipboard - Not as Easy as You'd Think! |
| 2021-10-18/a> | Xavier Mertens | Malicious PowerShell Using Client Certificate Authentication |
| 2021-10-01/a> | Xavier Mertens | New Tool to Add to Your LOLBAS List: cvtres.exe |
| 2021-05-28/a> | Xavier Mertens | Malicious PowerShell Hosted on script.google.com |
| 2021-05-18/a> | Xavier Mertens | From RunDLL32 to JavaScript then PowerShell |
| 2021-05-06/a> | Xavier Mertens | Alternative Ways To Perform Basic Tasks |
| 2021-04-08/a> | Xavier Mertens | Simple Powershell Ransomware Creating a 7Z Archive of your Files |
| 2021-02-12/a> | Xavier Mertens | AgentTesla Dropped Through Automatic Click in Microsoft Help File |
| 2021-01-21/a> | Xavier Mertens | Powershell Dropping a REvil Ransomware |
| 2021-01-10/a> | Didier Stevens | Maldoc Analysis With CyberChef |
| 2021-01-09/a> | Didier Stevens | Maldoc Strings Analysis |
| 2020-12-24/a> | Xavier Mertens | Malicious Word Document Delivering an Octopus Backdoor |
| 2020-11-30/a> | Didier Stevens | Decrypting PowerShell Payloads (video) |
| 2020-11-25/a> | Xavier Mertens | Live Patching Windows API Calls Using PowerShell |
| 2020-11-19/a> | Xavier Mertens | PowerShell Dropper Delivering Formbook |
| 2020-11-05/a> | Xavier Mertens | Did You Spot "Invoke-Expression"? |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-23/a> | Xavier Mertens | Malicious Word Document with Dynamic Content |
| 2020-09-11/a> | Rob VandenBrink | What's in Your Clipboard? Pillaging and Protecting the Clipboard |
| 2020-08-28/a> | Xavier Mertens | Example of Malicious DLL Injected in PowerShell |
| 2020-08-20/a> | Rob VandenBrink | Office 365 Mail Forwarding Rules (and other Mail Rules too) |
| 2020-08-06/a> | Xavier Mertens | A Fork of the FTCode Powershell Ransomware |
| 2020-08-03/a> | Xavier Mertens | Powershell Bot with Multiple C2 Protocols |
| 2020-06-12/a> | Xavier Mertens | Malicious Excel Delivering Fileless Payload |
| 2020-05-15/a> | Rob VandenBrink | Hashes in PowerShell |
| 2020-05-15/a> | Rob VandenBrink | SHA3 Hashes (on Windows) - Where Art Thou? |
| 2020-04-27/a> | Xavier Mertens | Powershell Payload Stored in a PSCredential Object |
| 2020-04-24/a> | Xavier Mertens | Malicious Excel With a Strong Obfuscation and Sandbox Evasion |
| 2020-04-17/a> | Xavier Mertens | Weaponized RTF Document Generator & Mailer in PowerShell |
| 2020-04-10/a> | Xavier Mertens | PowerShell Sample Extracting Payload From SSL |
| 2020-02-28/a> | Xavier Mertens | Show me Your Clipboard Data! |
| 2020-01-23/a> | Xavier Mertens | Complex Obfuscation VS Simple Trick |
| 2019-12-26/a> | Xavier Mertens | Bypassing UAC to Install a Cryptominer |
| 2019-12-09/a> | Didier Stevens | (Lazy) Sunday Maldoc Analysis |
| 2019-09-17/a> | Rob VandenBrink | Investigating Gaps in your Windows Event Logs |
| 2019-07-28/a> | Didier Stevens | Video: Analyzing Compressed PowerShell Scripts |
| 2019-07-11/a> | Xavier Mertens | Russian Dolls Malicious Script Delivering Ursnif |
| 2019-07-10/a> | Rob VandenBrink | Dumping File Contents in Hex (in PowerShell) |
| 2019-06-28/a> | Rob VandenBrink | Verifying Running Processes against VirusTotal - Domain-Wide |
| 2019-06-27/a> | Rob VandenBrink | Finding the Gold in a Pile of Pennies - Long Tail Analysis in PowerShell |
| 2019-06-21/a> | Rob VandenBrink | Netstat Local and Remote -new and improved, now with more PowerShell! |
| 2019-06-03/a> | Didier Stevens | Tip: BASE64 Encoded PowerShell Scripts are Recognizable by the Amount of Letter As |
| 2019-05-28/a> | Didier Stevens | Office Document & BASE64? PowerShell! |
| 2019-04-25/a> | Rob VandenBrink | Service Accounts Redux - Collecting Service Accounts with PowerShell |
| 2019-04-24/a> | Rob VandenBrink | Where have all the Domain Admins gone? Rooting out Unwanted Domain Administrators |
| 2019-03-30/a> | Didier Stevens | "404" is not Malware |
| 2019-03-20/a> | Rob VandenBrink | Using AD to find hosts that aren't in AD - fun with the [IPAddress] construct! |
| 2019-03-10/a> | Didier Stevens | Malicious HTA Analysis by a Reader |
| 2019-03-10/a> | Didier Stevens | Quick and Dirty Malicious HTA Analysis |
| 2019-03-05/a> | Rob VandenBrink | Powershell, Active Directory and the Windows Host Firewall |
| 2019-02-21/a> | Xavier Mertens | Simple Powershell Keyloggers are Back |
| 2019-02-17/a> | Didier Stevens | Video: Finding Property Values in Office Documents |
| 2019-02-16/a> | Didier Stevens | Finding Property Values in Office Documents |
| 2019-02-10/a> | Didier Stevens | Video: Maldoc Analysis of the Weekend |
| 2019-02-09/a> | Didier Stevens | Maldoc Analysis of the Weekend |
| 2019-01-24/a> | Brad Duncan | Malspam with Word docs uses macro to run Powershell script and steal system data |
| 2019-01-14/a> | Rob VandenBrink | Microsoft LAPS - Blue Team / Red Team |
| 2019-01-02/a> | Xavier Mertens | Malicious Script Leaking Data via FTP |
| 2018-12-19/a> | Xavier Mertens | Restricting PowerShell Capabilities with NetSh |
| 2018-12-15/a> | Didier Stevens | De-DOSfuscation Example |
| 2018-12-12/a> | Didier Stevens | Yet Another DOSfuscation Sample |
| 2018-12-03/a> | Didier Stevens | Word maldoc: yet another place to hide a command |
| 2018-11-22/a> | Xavier Mertens | Divided Payload in Multiple Pasties |
| 2018-11-16/a> | Xavier Mertens | Basic Obfuscation With Permissive Languages |
| 2018-11-06/a> | Xavier Mertens | Malicious Powershell Script Dissection |
| 2018-10-26/a> | Xavier Mertens | Dissecting Malicious Office Documents with Linux |
| 2018-10-22/a> | Xavier Mertens | Malicious Powershell using a Decoy Picture |
| 2018-09-30/a> | Didier Stevens | When DOSfuscation Helps... |
| 2018-09-05/a> | Xavier Mertens | Malicious PowerShell Compiling C# Code on the Fly |
| 2018-07-30/a> | Didier Stevens | Malicious Word documents using DOSfuscation |
| 2018-07-26/a> | Xavier Mertens | Windows Batch File Deobfuscation |
| 2018-06-19/a> | Xavier Mertens | PowerShell: ScriptBlock Logging... Or Not? |
| 2018-06-04/a> | Rob VandenBrink | Digging into Authenticode Certificates |
| 2018-05-19/a> | Xavier Mertens | Malicious Powershell Targeting UK Bank Customers |
| 2018-05-09/a> | Xavier Mertens | Nice Phishing Sample Delivering Trickbot |
| 2018-05-06/a> | Guy Bruneau | Scans Attempting to use PowerShell to Download PHP Script |
| 2018-03-04/a> | Xavier Mertens | The Crypto Miners Fight For CPU Cycles |
| 2017-11-29/a> | Xavier Mertens | Fileless Malicious PowerShell Sample |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-11/a> | Xavier Mertens | Keep An Eye on your Root Certificates |
| 2017-10-31/a> | Xavier Mertens | Some Powershell Malicious Code |
| 2017-09-11/a> | Russ McRee | Windows Auditing with WINspect |
| 2017-08-23/a> | Xavier Mertens | Malicious script dropping an executable signed by Avast? |
| 2017-08-20/a> | Didier Stevens | It's Not An Invoice ... |
| 2017-08-01/a> | Rob VandenBrink | Rooting Out Hosts that Support Older Samba Versions |
| 2017-05-03/a> | Bojan Zdrnja | Powershelling with exploits |
| 2017-03-30/a> | Xavier Mertens | Diverting built-in features for the bad |
| 2017-02-17/a> | Rob VandenBrink | RTRBK - Router / Switch / Firewall Backups in PowerShell (tool drop) |
| 2016-12-02/a> | Rob VandenBrink | Protecting Powershell Credentials (NOT) |
| 2016-11-23/a> | Tom Webb | Mapping Attack Methodology to Controls |
| 2016-10-31/a> | Russ McRee | SEC505 DFIR capture script: snapshot.ps1 |
| 2016-06-03/a> | Tom Liston | MySQL is YourSQL |
| 2016-04-28/a> | Rob VandenBrink | DNS and DHCP Recon using Powershell |
| 2016-04-15/a> | Xavier Mertens | Windows Command Line Persistence? |
| 2016-01-26/a> | Rob VandenBrink | Pentest Time Machine: NMAP + Powershell + whatever tool is next |
| 2016-01-25/a> | Rob VandenBrink | Assessing Remote Certificates with Powershell |
| 2016-01-19/a> | Rob VandenBrink | Powershell and HTTPS ? It Ain?t All Rainbows And Lollipops! (or is it?) |
| 2016-01-06/a> | Russ McRee | toolsmith #112: Red vs Blue - PowerSploit vs PowerForensics |
| 2015-12-14/a> | Russ McRee | AD Security's Unofficial Guide to Mimikatz & Command Reference |
| 2015-12-10/a> | Rob VandenBrink | Uninstalling Problem Applications using Powershell |
| 2015-12-09/a> | Xavier Mertens | Enforcing USB Storage Policy with PowerShell |
| 2015-12-02/a> | Rob VandenBrink | Nessus and Powershell is like Chocolate and Peanut Butter! |
| 2015-08-12/a> | Rob VandenBrink | Windows Service Accounts - Why They're Evil and Why Pentesters Love them! |
| 2015-06-29/a> | Rob VandenBrink | The Powershell Diaries 2 - Software Inventory |
| 2015-06-24/a> | Rob VandenBrink | The Powershell Diaries - Finding Problem User Accounts in AD |
| 2014-10-23/a> | Russ McRee | Digest: 23 OCT 2014 |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2013-02-28/a> | Daniel Wesemann | Parsing Windows Eventlogs in Powershell |
| 2011-11-10/a> | Rob VandenBrink | Stuff I Learned Scripting - - Parsing XML in a One-Liner |
ISE |
| 2024-09-24/a> | Johannes Ullrich | Exploitation of RAISECOM Gateway Devices Vulnerability CVE-2024-7120 |
| 2023-01-17/a> | Johannes Ullrich | Packet Tuesday: IPv6 Router Advertisements https://www.youtube.com/watch?v=uRWpB_lYIZ8 |
| 2021-11-14/a> | Didier Stevens | External Email System FBI Compromised: Sending Out Fake Warnings |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-17/a> | Xavier Mertens | Suspicious Endpoint Containment with OSSEC |
| 2020-09-15/a> | Brad Duncan | Traffic Analysis Quiz: Oh No... Another Infection! |
| 2020-08-05/a> | Brad Duncan | Traffic Analysis Quiz: What's the Malware From This Infection? |
| 2020-01-06/a> | Johannes Ullrich | Increase in Number of Sources January 3rd and 4th: spoofed |
| 2019-07-18/a> | Xavier Mertens | Malicious PHP Script Back on Stage? |
| 2018-06-22/a> | Lorna Hutcheson | XPS Attachment Used for Phishing |
| 2016-08-29/a> | Russ McRee | Recommended Reading: Intrusion Detection Using Indicators of Compromise Based on Best Practices and Windows Event Logs |
| 2015-03-07/a> | Guy Bruneau | Should it be Mandatory to have an Independent Security Audit after a Breach? |
| 2014-07-19/a> | Russ McRee | Keeping the RATs out: the trap is sprung - Part 3 |
| 2014-07-18/a> | Russ McRee | Keeping the RATs out: **it happens - Part 2 |
| 2014-07-16/a> | Russ McRee | Keeping the RATs out: an exercise in building IOCs - Part 1 |
| 2014-03-22/a> | Guy Bruneau | How the Compromise of a User Account Lead to a Spam Incident |
| 2013-04-15/a> | Rob VandenBrink | Oops - You Mean That Deleted Server was a Certificate Authority? |
| 2013-01-09/a> | Richard Porter | The 80's called - They Want Their Mainframe Back! |
| 2012-05-17/a> | Johannes Ullrich | New IPv6 Video: IPv6 Router Advertisements https://isc.sans.edu/ipv6videos |
| 2011-09-26/a> | Jason Lam | MySQL.com compromised spreading malware |
| 2011-07-11/a> | John Bambenek | Another Defense Contractor Hacked in AntiSec Hacktivism Spree |
| 2011-06-19/a> | Guy Bruneau | Sega Pass Compromised - 1.29 Million Customers Data Leaked |
| 2011-04-18/a> | John Bambenek | Wordpress.com Security Breach |
| 2011-04-02/a> | Rick Wanner | RSA/EMC: Anatomy of a compromise |
| 2011-02-21/a> | Adrien de Beaupre | Winamp forums compromised |
| 2010-12-13/a> | Deborah Hale | Gawker Media Breach of Security |
| 2010-02-28/a> | Mari Nichols | Disasters take practice |
| 2010-01-26/a> | Jason Lam | e107 CMS system website compromised |
| 2009-10-05/a> | Adrien de Beaupre | Time to change your hotmail/gmail/yahoo password |
| 2009-08-28/a> | Adrien de Beaupre | apache.org compromised |
| 2009-07-29/a> | Bojan Zdrnja | Increasing number of attacks on security sites |
| 2009-07-11/a> | Marcus Sachs | Imageshack |
| 2008-11-16/a> | Maarten Van Horenbeeck | Detection of Trojan control channels |
| 2008-08-25/a> | John Bambenek | Thoughts on the Best Western Compromise |
| 2006-12-12/a> | Swa Frantzen | Offline Microsoft Patching |
