Awesome! I hope you really enjoyed these demos.
If you like the PowerSploit framework, I have good news for you.
There're tons of attacks that can be performed in this too.
For example, you can use PowerSploit for reconnaissance,
such as identifying users and computers in the domain.
And also you can use PowerSploit for code execution,
meaning that PowerSploit helps you to inject malicious code into
current processes and also some other code execution techniques.
PowerSploit can also be used for privilege escalation since it
contains a lot of scripts that help you to identify misconfigurations
that can lead to privilege escalation. And also PowerSploit has a
whole module about persistence.
For example,
you can use PowerSploit to set up hidden services or hidden scheduled tasks.
And believe it or not, PowerSploit also has a model for antivirus bypass,
which contains code obfuscation scripts. And last but also really
important, PowerSploit has a few tools for data exfiltration,
which will help us to encrypt the data and send it outside of the
network in ways to blend with normal traffic. Pretty cool,
right? Just to have an idea, PowerSploit covers a total of 23
tactics from the Mitre Att&ck framework.
So before we go,
I want to leave you with more information about this really interesting tool.
First,
the official documentation. In the PowerSploit GitHub, you
can find details about several of the modules and even some
examples of how to run the tags.
But if you want to get really good at PowerSploit, I can recommend you a
really good course here at Pluralsight. It's called Getting Started with
PowerSploit. This course is over two hours long and covers the main attacks
that we can perform with PowerSploit. Also,
if you're interested in antivirus invasion, you can check
out another course here at Pluralsight called Defense
Evasion with Invoke‑Obfuscation.
In there,
you learn how to bypass the majority of the traditional
antivirus solutions with an invoke‑obfuscation tool.
And if you're wondering how to prevent your company from
being exploited by the PowerSploit framework,
I have two suggestions.
First, as you may have noticed,
using traditional signature‑based antivirus solutions may not be enough.
So I do recommend you using detection tools in each
machine that detect abnormal user behavior.
And in addition to that, network detection tools that look for abnormal
behavior in network traffic. And the keyword here is behavior instead of
looking for just malware signatures. For example,
if you see a user trying to access dozens of network
file shares in less than 10 seconds, then it is something to be alerted.
So that's it. This is the end of our Collection with PowerSploit course.
Thank you for watching, and I'll see you soon.