Reply to thread

Message

<blockquote data-quote="Emmanuellws" data-source="post: 619652" data-attributes="member: 60108"><p>Same, I felt that they rigged the test for most of the product, Panda would have popped up that powershell too..but it didn&#039;t unless they unblock it from the console. .But to understand more about variety of powershell attacks... the attacker actually can change the powershell name to something else, and if it runs directly from the memory, none of the product can actually catch powershell.exe bcoz they are using their own custom powershell program from their console and launch and call the dll from the victim&#039;s machine directly. So many ways to launch powershell, can bypass whitelisting technology, can bypass AV and only through ADsecurity&#039;s video you may find out why and how to actually protect from the most advance powershell attack. Application whitelisting only blocks powershell.exe from running automatically called from other application or files. But won&#039;t be able to block its own custom powershell app running in the memory as well as a method called &quot;Invoke Obfuscation Attack&quot;. None of the product in the market alone can protect computers from this attack. Watch the video, only you will understand what I mean.</p></blockquote><p></p>

[QUOTE="Emmanuellws, post: 619652, member: 60108"] Same, I felt that they rigged the test for most of the product, Panda would have popped up that powershell too..but it didn't unless they unblock it from the console. .But to understand more about variety of powershell attacks... the attacker actually can change the powershell name to something else, and if it runs directly from the memory, none of the product can actually catch powershell.exe bcoz they are using their own custom powershell program from their console and launch and call the dll from the victim's machine directly. So many ways to launch powershell, can bypass whitelisting technology, can bypass AV and only through ADsecurity's video you may find out why and how to actually protect from the most advance powershell attack. Application whitelisting only blocks powershell.exe from running automatically called from other application or files. But won't be able to block its own custom powershell app running in the memory as well as a method called "Invoke Obfuscation Attack". None of the product in the market alone can protect computers from this attack. Watch the video, only you will understand what I mean. [/QUOTE]

Verification