DFSP # 435 - Good Ol’ Powershell

Digital Forensic Survival Podcast

Threat actors often exploit PowerShell in cyber attacks due to its capabilities and integration with Windows operating systems. Microsoft has cited powershell as one of the most commonly used tools in the attack chain. It also comes up in phishing campaigns and other attacks that include infecting URL links. The challenge lies in the fact that it is a commonly used administration tool. As an analyst, you can expect to have lots of powershell scripts and commands come up during your investigations. Your job is to be able to differentiate between the good and bad. Fortunately, this episode is going to give you some tips and tricks on how to do exactly that...