Invoke-Mayhem: PowerShell Abuse and Detection

Overview

There has been a lot of talk recently in the cybersecurity community about whether or not PowerShell is a dead attack vector. But there is a reason it is still widely talked about and seen in the wild. During this workshop, The SCYTHE Labs team will demonstrate how threats are still using and abusing PowerShell to Live off the Land (LOTL) and how you can detect the abuse.

What to Expect:
🦄 Learn how PowerShell is being abused in the wild.
🦄 Learn how to detect PowerShell Usage.
🦄 Learn how to recognize the use of unmanaged PowerShell.
🦄 Learn how to recognize common Living-Off-The-Land (LOTL) techniques.