TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

New PowerShell History Defense Evasion Technique

Kassie Kimball · 2022-11-29 · Read original ↗

ATT&CK techniques detected

4 predictions
T1059.001PowerShell
99%
“temp \ out. txt use contrainedlanguage mode : $ executioncontext. sessionstate. languagemode = “ constrainedlanguage ” if you are interested in learning more about powershell topics such as ‘ just enough admin ’, powershell remoting, language modes and more, check out my 16 - hou…”
T1070.003Clear Command History
92%
“written to the history file. we could disable all history logging for the current session as follows : - set - psreadlineoption - addtohistoryhandler { return $ false } the “ addtohistoryhandler ” receives the current command as the $ line variable and then returns $ true if the …”
T1070.003Clear Command History
90%
“’ t support this feature, however it can easily be updated. let ’ s see the sensitive history scrubbing in action. in the image above, we ran three commands, one of which contained one of the words that trigger the “ sensitive ” filter. notice that the password line is not listed…”
T1070.003Clear Command History
89%
“new powershell history defense evasion technique new powershell history defense evasion technique powershell incorporates the handy feature of writing commands executed to a file to make them easy to refer back to later. this functionality is provided by the psreadline module. th…”

Summary

Carrie Roberts // PowerShell incorporates the handy feature of writing commands executed to a file to make them easy to refer back to later. This functionality is provided by the […]

The post New PowerShell History Defense Evasion Technique appeared first on Black Hills Information Security, Inc..