Using Pester & ScriptAnalyzer for Detecting Obfuscated...
summary
Shows concrete detections: combines PesterSec tests and ScriptAnalyzer + AST rules to find token‑level obfuscation that ScriptBlock logging leaves behind. Demonstrates Revoke‑Obfuscation and PSAmsi workarounds, reports the Invoke‑Obfuscation harness produces at most 56 unique invocations, and a handful of regex rules catch 8 of 28 syntaxes while AST rules flag long member names, tick marks, special‑char-heavy tokens and anomalies from a 400,000‑script corpus. Includes working measurements and rule outputs so defenders can reproduce and extend.
AI-written summary · about
chapters (10)
- 0:00Detecting obfuscated PowerShell
- 8:18Script block logging importance
- 13:08Static signature approaches
- 15:16Revoke-Obfuscation techniques
- 20:28Minimal obfuscation bypasses
- 24:02PesterSet leveraging abstract syntax trees
- 31:47AST-based detection
- 34:57PowerShell event log comparison
- 38:05Key takeaways
- 40:31Q&A
related talks
47mJavaScript Obfuscation: It’s All About the P a c k e r s
26mAn Effective Approach to Software Obfuscation
01h 40mDefending against PowerShell attacks - in theory, and in practice
49mPowerShell obfuskation Techniques & How To Detect Them
45m"Advanced Malware Threat: handling obfuscated code using..."
23mNext-Generation of Exploit Kit Detection By Building Simulated Obfuscators
48mStop Writing Insecure PowerShell... Seriously.
29mSyntia: Synthesizing the Semantics of Obfuscated Code