The Detection Series: PowerShell

  • Red Canary
The Detection Series: PowerShell

Webinar

Installed on nearly every Windows operating system in the world, PowerShell is a versatile tool for automation and remote system management that’s beloved by administrators and adversaries alike. It allows adversaries to execute commands, obfuscate malicious activity, download arbitrary binaries, gather information, change system configurations, and much more—all while blending in with routine operating system activity.

Attendees will leave with a better understanding of what PowerShell is and how adversaries leverage it. More importantly, practitioners will know where to find malicious activity, how to develop detection analytics for it, and how to test their detection and visibility capabilities.

In this Red Canary Detection Series webinar, experts from VMware Carbon Black, MITRE ATT&CK®️, and Red Canary will provide insight into:

  1. Common ways that adversaries abuse PowerShell
  2. Tools and log sources that collect relevant telemetry
  3. How to detect, mitigate, and respond to malicious PowerShell activity
  4. Strategies for testing your security controls by executing suspicious PowerShell commands with Atomic Red Team

Speakers

  1. David Davis Author, Speaker, and vExpert ActualTech Media
  2. Matt Graeber Director, Threat Research Red Canary
  3. Sarah Lewis Senior Detection Engineer Red Canary
  4. Jamie Williams Principal Adversary Emulation Engineer MITRE ATT&CK
  5. Casey Parman Manager & Lead, Threat Analysis Unit VMware