And there are other ways that you can detect all of the other technique.
We've kind of focused on PowerShell, but we talked about WMI.
WMI is being used more and more by attackers, and so you can use Sysmon.
Sysmon does really good at looking for WMI logs or logging WMI activity,
and then you can go in and look at those WMI logs to see what activity that was,
and again, baseline your systems.
Look to see what the normal activity is,
and then you can pull out the anomalous activity.
If you wanted to look on systems for things like the event subscriptions
through WMI that attackers are using for persistence,
Autoruns is a great tool that will do that.
Another Sysinternals tools.
one of the things that it pulls out are all WMI subscriptions.
The forensics PowerShell scripts Kansa.
They will also, you can use those to pull out WMI event subscriptions as well.
So let's say you didn't want to run Autoruns on all your systems,
you could write a PowerShell script and deploy that everywhere,
and just pull those out,
and throw those into a database or an ELK stack and
just kind of look at the anomalies.
Like we said,
when you look at all of the different systems across your organization,
you should only have pretty much the same event subscriptions on all of them.
So as you stack all of the ones that you pull back and list them,
if one system has an event subscription that's not in the other system,
you should definitely look at that to see why is that anomaly there.
So you use the unique case as the indicator of compromise --- Right, yes.
--- or likely.
Right.
Yeah, that's great.
And I think what's really cool too is everything we've talked
about for this kind of cutting edge detection stuff for
instant response and investigation.
We didn't really mention any commercial things,
and I'm sure there is commercial stuff starting to catch up.
But it seems that as attackers develop different methodologies,
the first thing to catch up is going to be hey,
you can write a PowerShell script to detect those.
Exactly.
And a lot of people have.
There are some really brilliant security people out there,
and they're using PowerShell to detect all of this,
or they're releasing free tools in order to help you detect all of this.
And I know a lot of organizations are maybe a little bit hesitant to
use open-source tools or freely available tools,
but if the commercial tool doesn't have it,
you need to have something that does it.
And if the tool is free with no cost, you can't beat that,
and it works, and definitely go for it.
If you encourage your people to use these open-source methodologies and tools,
they're also going to be learning how things work
because not all this stuff is like a nice,
pretty GUI.
You have to kind of know what you're looking for any why.
Exactly.
There is a difference between the skill of an analyst and the
maturity of an organization when you have people that know to point
and click in a GUI and get the results versus somebody who
understands what's going on in the background.
So when that GUI breaks,
they can still get at that information and do that analysis,
and that's really what sets apart the mature organizations
from the ones that are just starting out.
Yeah, excellent.
And I think anyone watching can take even just some
of the stuff you just did now, run that on some of your boxes,
and see if there's some stuff that you don't know about.
Exactly.
And not only what we're talking about,
there's obviously so much more regarding this,
and throwing it back to us.
Pluralsight has a lot of the training that will
teach you all of this stuff as well.
And so if nothing else,
that is a huge resource to help mature your organization to
get it to the point that it needs to be.
And as you learn how maybe you go do some security for
development stuff and you start learning like oh yeah,
this is how.
NET code works,
and here is how I could search for that and what those strings would look like,
maybe write your own DeepBlueCLI for your code compiling.
The next generation of security people or analysts who are writing
these tools are coming up in the environment now.
And so having these tools to kind of use and base their
stuff off of means that in 1 year, or 5 years,
10 years from now, we're just going to be so much better off as an industry.