DC608 Monthly Meetup - Power in the Shell: Learning PowerShell by Malware
Details
Join us for our monthly meetup! PowerShell is Microsoft's modern command shell built on .NET, combining the best features of popular shells while accepting and returning .NET objects instead of plain text. It comes pre-installed on every Windows computer (66.5% of the desktop market) and is widely known for task automation and cross-platform support as of PowerShell 7. Its deep integration with the Windows OS, access to the Win32 API, and ability to execute code directly in memory make it extraordinarily powerful in Windows environments.
In this talk, we'll explore PowerShell's capabilities through the lens of real malware samples — examining how attackers use it and what those techniques reveal about what PowerShell is truly capable of.
Morgen Nicodemus, also known as ChurchOfJorts, is a Security Analyst with an interest in malware, PowerShell, reverse engineering, and cutting up jeans. Off the computer, you can find Morgen rock climbing, sword fighting, or playing bass.