WhyMI so Sexy - WMI Attacks, Real Time Defense and Advanced Forensic Analysis

Explore Windows Management Instrumentation (WMI) attacks, real-time defense strategies, and advanced forensic analysis techniques in this comprehensive conference talk from BSidesLV 2015. Delve into the intricacies of WhyMI, PowerShell query language, and eventing. Examine potential attack vectors, providers, and PowerShell eggs. Gain insights into APT29 techniques and learn advanced forensic analysis methods, including reverse engineering WMI. Discover practical applications through demonstrations of WMI tools and real-time WMI monitoring. Enhance your understanding of WMI security implications and forensic parsing techniques to better protect and analyze Windows systems.

Introduction
WhyMI
PowerShell
Query Language
Eventing
Possible Attacks
Providers
PowerShell Eggs
APT29 Im They
Advanced Forensic Analysis
Reverse Engineering
WMI
Whitepaper
Forensic parsers
Demo
WMI Tool
WMI in Real Time