The PowerShell Risk: Understanding and Avoiding PowerShell Attacks

Presented by

Lee Lawson, Special Operation Resercher, SecureWorks Counter Threat Unit

About this talk

In a recent SecureWorks engagement, 98.5% of the 3,477 commands executed by threat actors were native to the Windows operating system. PowerShell is a popular tool that Microsoft has been including with the Windows OS since 2009, but malicious PowerShell use is rivaling ransomware in popularity with threat actors. Security products focused on preventing endpoint threats are often not enough to differentiate legitimate from malicious PowerShell use. Join us for a discussion of why PowerShell is so risky, how SecureWorks researchers identify PowerShell threats, and how you can defend your organization. SecureWorks Counter Threat Unit - Special Operations Researcher, Lee Lawson, will discuss how security leaders and practitioners can leverage his experience to reduce the risk and understand how to defend against PowerShell threats in your organizations. You Will Learn: • What PowerShell is and how it is used in “living off the land” attacks • Why built-in tools like PowerShell are so attractive to threat actors • Examples of malicious PowerShell use • How to defend your organization against common methods to evade prevention and detection

Related topics:

More from this channel

Upcoming talks (0)
On-demand talks (83)
Subscribers (14656)
Secureworks® (NASDAQ: SCWX) a global cybersecurity leader, enables our customers and partners to outpace and outmaneuver adversaries with more precision, so they can rapidly adapt and respond to market forces to meet their business needs. With a unique combination of cloud-native, SaaS security platform and intelligence-driven security solutions, informed by 20+ years of threat intelligence and research, no other security platform is grounded and informed with this much real-world experience. www.secureworks.com