So we've kind of established the baseline I want to follow,
fileless malware is going to be.
But really,
knowing that we have to shift from signature analysis to behavior
analysis to be able to catch this kind of stuff.
And the first step in that is find out how it works.
Exactly.
It's really important to understand how,
what these techniques are because there are multiple
techniques that the attackers are going to use in their
fileless attacks and the fileless malware.
And by looking and understanding at least what the patterns
of those are or what they may look like,
then you're going to be able to look at a system
and recognize when that occurred.
So you mentioned PowerShell.
That was one that came up, and that's probably a biggie.
Can you explain a little more about what that would look like and how it's used?
Yeah.
PowerShell has been on Windows systems since I think Windows 7.
It's been available before that, but it's been standard since Windows 7.
Yeah, v2 in Windows 7 made remoting a lot easier and things.
And PowerShell is just like it sounds.
I mean, it's extremely powerful.
Let's face it, it can pretty much do anything.
The security world has kind of embraced PowerShell,
and so there are lots of PowerShell based attack toolkits out there.
There are forensic toolkits based around PowerShell.
It can pretty much do anything that you want to on the system,
and even better, you can script everything out.
So you don't have to be in front of a GUI anymore
in order to administer a system.
Well, attackers have realized this,
and they use this to their advantage because PowerShell is ready to run on
pretty much every Windows operating system that's out there,
in an enterprise at least.
They can use it to download additional malware.
They can use it to inject into other processes to make themselves persist.
There is just so much that can be done.
It's pretty rare nowadays, I think,
to see an attack that does not involve PowerShell.
And so from a perspective of using batch scripts or VBS versus PowerShell,
I imagine PowerShell has a lot more access to the underlying OS.
Is that the advantage there?
It is.
That's the exact advantage.
One of the advantages to attackers too is that depending on
the version of PowerShell that you're using,
there may be very little logging by default.
With PowerShell 2, which is the standard version in Windows 7 by default,
I think maybe even Windows 10 may come with PowerShell 2 by default,
it has very little logging that occurs.
As PowerShell has progressed from 3, to 4,
to 5, you get more and more default logging and in PowerShell 5,
you have a lot.
and PowerShell 5 will even log suspicious things by default,
suspicious activity that occurs in PowerShell by default.
However, as a defender or as an investigator,
you want to have it logging everything,
and so there's additional things that you need to turn on in order to
find this fileless malware that's using PowerShell.
And in some environments,
command line is kind of not allowed to be used by users,
but then PowerShell is still available.
It is.
Some people of kind of caught on, Group Policy or whatever,
to be able to able to lock down the command line to only admin users,
but users still have full reign over PowerShell.
It can still be executed.
There are some restrictions that you can put into place to prevent scripts
that are downloaded from being executed through PowerShell.
Unsigned scripts.
Exactly, but those are easily bypassed.
Yeah, I think I've done that myself quite a bit.
You just, even in the environments where command line is not available,
you can still run batch scripts because batch scripts are apart of
Windows and a lot of the scheduled tasks use those.
And then you can just,
it's literally an attack that says attack bypass execution policy,
and then your policy doesn't matter.
Yup, that's exactly it.
It's so easy to bypass that it's really not a,
nobody should be using that as a security protection.
You just assume that the attacker is going to be able to get past that.
I think that's a security protection from people
who aren't trying to attack you.
Exactly.
One quick Google search and you will find out how to get around it.
Thanks, Google.
Yup, exactly.