Flip the Script: PowerShell "Microsoft’s Incident Response Language" - Jared Atkinson
Channel: PowerShell Conference EU
Date: 09/05/2017

What administration and automation tool do state-sponsored actors like APT 29, criminal actors like Phineas Fisher, and IT staff all rely upon heavily? PowerShell. Integrated into many offensive toolkits, PowerShell is gaining respect in offensive circles as 'Microsoft's Post-Exploitation Language'. In a quest to combat this perceived threat, many defenders attempt to disable PowerShell rather than realizing its defensive potential. In this talk, we will cover PowerShell defensive tools and techniques that you can effectively use to detect malicious activity without the need for a bloated host-based agent.  Don't be afraid of PowerShell! Fight back, instill fear in the attacker, and reclaim your enterprise! It’s time to acknowledge PowerShell as 'Microsoft’s Incident Response Language'!
Speaker: Jared Atkinson

Slides and demo code for this and other sessions will be released on https://github.com/psconfeu/2017 over the next few weeks.