A Survey of Powershell Enabled Malware

Explore a comprehensive survey of PowerShell-enabled malware in this 24-minute conference talk from Derbycon 2015. Delve into various malware types, including vaudetrack macros, password protection techniques, and registry entry exploits. Examine specific malware examples like Pollux, Jameer, PoshCoder, and krypter. Learn about advanced threats such as RSA Happy Cat, Shadow Files, and Power Worm. Investigate Point of Sale attacks, proof of concept demonstrations, and the PowerShell Framework. Discover defense strategies, including Base64 decoding and resource utilization, to combat these sophisticated threats.

Intro
Agenda
Malware
vaudetrack
macros
password protection
macro
debugger
vaudtrack
flow
Pollux
Registry Entry
Jameer
PoshCoder
krypter
RSA
Happy Cat
Shadow Files
Shadow Explorer
Power Worm
Matt Graver
Deep Panda
Point of Sale
Proof of Concept
Powershell Framework
Mimicat
Fuzzy Knob
Ask
Unicorn
Base64
Defense
Resources