43,479 blogs · 5,502,589 posts Claim your blog

Record · corpus.blog/posts/01a0879c-2528-7350-b9ec-13547e06a742

PowerView is evil, but PowerVi and ew are legit, right? - Missing signature-based detections due to PowerShell Script Block Logging Fragmentation

lolcads.github.io · published 15 April 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at lolcads.github.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 11
Words captured: 1,371

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://x.com/nas_bench/status/1806253324456403316

x.com

https://github.com/PowerShell/PowerShell/blob/7ec8e4ed8f47e81e70de5353500f8a01d5fe396c/src/System.Management.Automation/engine/runtime/CompiledScriptBlock.cs

github.com

https://github.com/SigmaHQ/sigma

github.com

https://devblogs.microsoft.com/powershell/powershell-the-blue-team/

devblogs.microsoft.com

https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

github.com

https://github.com/SigmaHQ/sigma/releases/tag/r2024-03-11

github.com

https://github.com/WithSecureLabs/chainsaw

github.com

https://github.com/SigmaHQ/sigma/blob/4319f5807ff4eb8035ecf1a8f86ab3bdc1ab8960/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml

github.com

https://github.com/SigmaHQ/sigma/blob/49adcf9a00247ed6c3daacba03b589470f6716d0/rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml

github.com

https://news.sophos.com/en-us/2022/03/29/reconstructing-powershell-scripts-from-multiple-windows-event-logs/

news.sophos.com

https://www.cyber.gov.au/sites/default/files/2023-03/PROTECT%20-%20Windows%20Event%20Logging%20and%20Forwarding%20%28October%202021%29.pdf

cyber.gov.au